PT-2023-12256 · Unknown+1 · Yupoxion Bearadmin+1

Szfsiro · Publicado 2023-02-17 · Atualizado 2025-03-18 · CVE-2021-35261

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075

Description The issue allows an attacker to execute arbitrary remote code via the Upfile function of the "extend/tools/Ueditor" endpoint. This enables remote code execution, potentially leading to severe security consequences.

Recommendations For Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075, consider disabling the Upfile function of the extend/tools/Ueditor endpoint as a temporary workaround until a patch is available. Restrict access to the extend/tools/Ueditor endpoint to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2021-35261

Produtos afetados

Ueditor

Yupoxion Bearadmin

Referências · 5

• 🔥 https://github.com/yupoxiong/BearAdmin/issues/16 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-35261 · Nota de Segurança
• https://t.me/cvenotify/44586 · Publicação no Telegram
• https://t.me/cvenotify/115197 · Publicação no Telegram
• https://t.me/cibsecurity/58457 · Publicação no Telegram