PT-2021-20159 · Dutchcoders · Transfer.Sh

Ryotak · Published 2021-05-24 · Updated 2024-08-21 · CVE-2021-33497

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dutchcoders transfer.sh versions prior to 1.2.4

Description The issue allows Directory Traversal, which can be used for deleting files. This can potentially lead to unauthorized access and modification of sensitive data.

Recommendations For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-33497

GHSA-CF55-RQ8X-HM6F

GO-2022-0925

Affected Products

Transfer.Sh

References · 9

• https://github.com/dutchcoders/transfer.sh/pull/373 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-33497 · Security Note
• https://osv.dev/vulnerability/GO-2022-0925 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33497 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cf55-rq8x-hm6f · Vendor Advisory
• https://github.com/dutchcoders/transfer.sh/releases/tag/v1.2.4 · Note
• https://vuln.ryotak.me/advisories/44 · Note
• https://t.me/cvenotify/14914 · Telegram Post
• https://github.com/advisories/GHSA-cf55-rq8x-hm6f · Note