CVE-2021-28132

2021-03-1106:33:40

mitre

www.cve.org

cve-2021-28132

migration tool

system.tar.gz

remote code execution

unauthenticated

lucy security awareness software

AI Score

Confidence

High

EPSS

0.011

Percentile

84.5%

JSON

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI.

References

abuyv.com/cve/lucy-file-upload-RCE