CVE-2021-44534

2024-05-3117:40:31

hackerone

github.com

user input filtering

arbitrary file read

non-authenticated attacker

sensitive information disclosure

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosure.

CNA Affected

[
  {
    "vendor": "ExpressionEngine",
    "product": "ExpressionEngine",
    "versions": [
      {
        "version": "6.0.3",
        "status": "affected",
        "lessThan": "6.0.3",
        "versionType": "semver"
      },
      {
        "version": "6.0.0",
        "status": "unaffected",
        "lessThan": "6.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

hackerone.com/reports/1096043