PT-2021-20329 · Cartadis · Cartadis Gespage

Olivier Thibault · Published 2021-07-12 · Updated 2021-09-20 · CVE-2021-33807

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cartadis Gespage versions 8.2.1 and earlier

Description: The issue allows Directory Traversal in the "gespage/doDownloadData" and "gespage/webapp/doDownloadData" API endpoints.

Recommendations: For Cartadis Gespage versions 8.2.1 and earlier, update to a version that fixes the Directory Traversal issue in the gespage/doDownloadData and gespage/webapp/doDownloadData API endpoints. As a temporary workaround, consider restricting access to the gespage/doDownloadData and gespage/webapp/doDownloadData API endpoints until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-33807

Affected Products

Cartadis Gespage

References · 7

• 🔥 https://on-x.com/sites/default/files/on-x_-_security_advisory_-_gespage_-_cve-2021-33807.pdf · Exploit
• https://gespage.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33807 · Vendor Advisory
• https://support.gespage.com/fr/support/solutions/articles/14000130201-security-advisory-gespage-directory-traversal · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33807 · Security Note
• https://cartadis.com/gespage-website · Note
• https://t.me/cvenotify/18383 · Telegram Post