CVE-2021-43828

🗓️ 14 Dec 2021 19:20:17Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 38 Views🌐 WEB

PatrOwl version prior to 1.7.7 allows unlogged-in users to download all finding import files due to improper privilege management (IDOR) in PatrowlManager

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2021-43828	14 Dec 202122:14	–	circl
CNNVD	PatrOwl 安全漏洞	14 Dec 202100:00	–	cnnvd
CNVD	PatrOwl privilege management error vulnerability	16 Dec 202100:00	–	cnvd
Cvelist	CVE-2021-43828 Improper Privilege Management in Patrowl	14 Dec 202119:20	–	cvelist
EUVD	EUVD-2021-30708	3 Oct 202520:07	–	euvd
NVD	CVE-2021-43828	14 Dec 202120:15	–	nvd
Prion	Design/Logic Flaw	14 Dec 202120:15	–	prion
Positive Technologies	PT-2021-23960 · Patrowl · Patrowl	14 Dec 202100:00	–	ptsecurity
RedhatCVE	CVE-2021-43828	22 May 202518:51	–	redhatcve

NVD

Vulners

Node

patrowl patrowlmanagerRange<1.7.7

[
  {
    "product": "PatrowlManager",
    "vendor": "Patrowl",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.7.7"
      }
    ]
  }
]

Source	Link
github	www.github.com/Patrowl/PatrowlManager/security/advisories/GHSA-x4wp-xvq7-w5vr
huntr	www.huntr.dev/bounties/fe6248f1-603d-43df-816c-c75534a56f72

Parameter	Position	Path	Description	CWE
owner_id	path	/media/imports/<owner_id>/<tmp_file>	Unauthenticated access to sensitive import files via predictable file path under /media/imports, enabling download of all finding imports without login.	CWE-639, CWE-269
tmp_file	path	/media/imports/<owner_id>/<tmp_file>	Unauthenticated access to sensitive import files via predictable file path under /media/imports, enabling download of all finding imports without login.	CWE-639, CWE-269

17 Jun 2026 04:11Current

7.5High risk

Vulners AI Score7.5

CVSS 25

CVSS 3.17.5

EPSS0.01373