Vulnerability Details : CVE-2021-41714
Potential exploit
In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage.
Products affected by CVE-2021-41714
- cpe:2.3:a:tipask:tipask:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-41714
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 30 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-41714
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST | |
|
7.7
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
3.1
|
4.0
|
MITRE | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2021-41714
-
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-41714
-
https://github.com/sdfsky/tipask/blob/c4e6aa9f6017c9664780570016954c0922d203b7/app/Http/Controllers/AttachController.php#L42
tipask/AttachController.php at c4e6aa9f6017c9664780570016954c0922d203b7 · sdfsky/tipask · GitHubExploit;Third Party Advisory
-
https://www.yuque.com/henry-weply/penetration/fza5hm
CVE：Tipask PostAuth LFR · 语雀Third Party Advisory
-
https://github.com/sdfsky/tipask/commit/9b5f13d1708e9a5dc0959cb8a97be1c32b94ca69
文件下载漏洞修正 · sdfsky/tipask@9b5f13d · GitHubPatch;Third Party Advisory
Jump to