CVE-2021-40875 : Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat ac

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The corresponding file paths can be tested, and in some cases, result in the disclosure of hardcoded credentials, API keys, or other sensitive data.

Published 2021-09-22 15:15:10

Updated 2022-07-12 17:42:04

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-40875

EPSS FAQ

43.58%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-40875

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2021-40875

https://johnjhacking.com/blog/cve-2021-40875/

John J Hacking
Exploit;Third Party Advisory
https://www.gurock.com/testrail/tour/enterprise-edition

Enterprise Edition - TestRail Tour
Product;Vendor Advisory
http://packetstormsecurity.com/files/164270/Gurock-Testrail-7.2.0.3014-Improper-Access-Control.html

Gurock Testrail 7.2.0.3014 Improper Access Control ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://github.com/SakuraSamuraii/derailed

GitHub - SakuraSamuraii/derailed: CVE-2021-40875: Tools to Inspect Gurock Testrail Servers for Vulnerabilities related to CVE-2021-40875.
Third Party Advisory

Products affected by CVE-2021-40875

Gurock » Testrail
Versions before (<) 7.2.0.3014
cpe:2.3:a:gurock:testrail:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2021-40875

Exploit prediction scoring system (EPSS) score for CVE-2021-40875

CVSS scores for CVE-2021-40875

CWE ids for CVE-2021-40875

References for CVE-2021-40875

Products affected by CVE-2021-40875