Vulnerability Details : CVE-2021-36389
In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".
Products affected by CVE-2021-36389
- cpe:2.3:a:yellowfinbi:yellowfin:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-36389
1.54%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 87 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-36389
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2021-36389
-
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-36389
-
http://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.html
Yellowfin Cross Site Scripting / Insecure Direct Object Reference ≈ Packet StormThird Party Advisory;VDB Entry
-
http://seclists.org/fulldisclosure/2021/Oct/15
Full Disclosure: Yellowfin < 9.6.1 Multiple VulnerabilitiesThird Party Advisory
-
https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.md
Yellowfin-Multiple-Vulnerabilities/README.md at main · cyberaz0r/Yellowfin-Multiple-Vulnerabilities · GitHubThird Party Advisory
-
https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6
Release Notes for Yellowfin 9 - Yellowfin Guide 9 - Global SiteRelease Notes;Vendor Advisory
-
https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities/
cyberaz0r Security Blog | Yellowfin Multiple Vulnerabilities
Jump to