PT-2021-18633 · Composer · Composer

Published 2021-04-06 · Updated 2021-04-08 · CVE-2021-30149

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Composr version 10.0.36

Description The issue allows for the upload and execution of PHP files, potentially leading to code execution.

Recommendations For Composr version 10.0.36, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-30149

Affected Products

Composer

References · 5

• 🔥 https://exploit-db.com/exploits/49753 · Exploit
• 🔥 http://packetstormsecurity.com/files/162128/Composr-10.0.36-Shell-Upload.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-30149 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30149 · Vendor Advisory
• https://gitlab.com/composr-foundation/composr/commit/a71c44e03 · Patch