PT-2021-18561 · Cloverdx · Cloverdx

Patryk Bogusz · Published 2021-06-09 · Updated 2022-05-25 · CVE-2021-29995

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CloverDX versions prior to 5.7.1 CloverDX versions 5.7.1 through 5.9.0

Description A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX allows remote attackers to execute any action as the logged-in user, including script execution.

Recommendations For versions prior to 5.7.1, update to CloverDX 5.7.1 or later. For versions 5.7.1 through 5.9.0, update to CloverDX 5.10, CloverDX 5.9.1, or CloverDX 5.8.2.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-29995

Affected Products

Cloverdx

References · 7

• 🔥 https://exploit-db.com/exploits/50166 · Exploit
• 🔥 http://packetstormsecurity.com/files/163697/CloverDX-5.9.0-Code-Execution-Cross-Site-Request-Forgery.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-29995 · Security Note
• https://support.cloverdx.com/releases · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29995 · Vendor Advisory
• https://support1.cloverdx.com/hc/en-us/articles/360021006520 · Vendor Advisory
• https://t.me/cvenotify/15987 · Telegram Post