CVE-2021-45790

2022-09-2903:15:14

Google

osv.dev

metersphere

arbitrary file upload

unauthenticated users

arbitrary directory

cron job

command execution

AI Score

7.2

Confidence

High

EPSS

0.004

Percentile

73.9%

JSON

An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, where attackers can write a cron job to execute commands.

References

github.com/metersphere/metersphere/issues/8653