Lucene search

MitreCVE-2021-35290

HistoryFeb 24, 2023 - 9:15 p.m.

CVE-2021-35290

2023-02-2421:15:10

CWE-434

mitre

web.nvd.nist.gov

cve

2021

35290

file upload

vulnerability

balerocms-src

remote attackers

arbitrary code

rich text editor

admin

mod-blog

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.002

Percentile

54.7%

JSON

File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page.

Affected configurations

Nvd

Node

balero_cms_projectbalero_cmsMatch0.8.3

VendorProductVersionCPE
balero_cms_projectbalero_cms0.8.3cpe:2.3:a:balero_cms_project:balero_cms:0.8.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
balero_cms_project	balero_cms	0.8.3	cpe:2.3:a:balero_cms_project:balero_cms:0.8.3:::::::*

References

github.com/anibalgomezprojects/balerocms-src/issues/2

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.002

Percentile

54.7%

JSON

Related for CVE-2021-35290