Lucene search

[email protected]NVD:CVE-2021-26633

HistoryJun 02, 2022 - 2:15 p.m.

CVE-2021-26633

2022-06-0214:15:28

CWE-89

[email protected]

web.nvd.nist.gov

maxboard

vulnerabilities

information leakage

privilege escalation

sql injection

local file inclusion

arbitrary file manipulation

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

49.2%

JSON

SQL injection and Local File Inclusion (LFI) vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulnerabilities can be exploited by manipulating a variable with a desired value and inserting and arbitrary file.

Affected configurations

Nvd

Node

linuxlinux_kernelMatch-

AND

maxbmaxboardRange<1.9.4

References

www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66745

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

49.2%

JSON

Related for NVD:CVE-2021-26633

cve1 cnvd1 cvelist1 prion1