Lucene search

MitreCVE-2021-33352

HistoryMar 08, 2023 - 10:15 p.m.

CVE-2021-33352

2023-03-0822:15:09

CWE-434

mitre

web.nvd.nist.gov

cve-2021-33352

wyomind help desk

magento 2 extension

arbitrary code execution

phar file upload

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.006

Percentile

79.2%

JSON

An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via a phar file upload in the ticket message field.

Affected configurations

Nvd

Node

wyomindhelp_deskRange<1.3.7magento_2

VendorProductVersionCPE
wyomindhelp_desk*cpe:2.3:a:wyomind:help_desk:*:*:*:*:*:magento_2:*:*

Vendor	Product	Version	CPE
wyomind	help_desk	*	cpe:2.3:a:wyomind:help_desk::::::magento_2::*

References

www.exploit-db.com/exploits/50113

www.wyomind.com/magento2/helpdesk-magento-2.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.006

Percentile

79.2%

JSON

Related for CVE-2021-33352