PT-2021-21120 · Unknown · Echo Sharecare

Nick Nam + 1 · Published 2021-07-13 · Updated 2021-07-15 · CVE-2021-36123

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Echo ShareCare version 8.15.5

Description: An issue was discovered in the TextReader feature, specifically in General/TextReader/TextReader.cfm, which is susceptible to a local file inclusion vulnerability. This occurs when processing remote input in the textFile parameter from an authenticated user, allowing the ability to read arbitrary files on the server filesystems as well as any files accessible via Universal Naming Convention (UNC) paths.

Recommendations: For Echo ShareCare version 8.15.5, consider disabling the TextReader feature or restricting access to the textFile parameter in the General/TextReader/TextReader.cfm endpoint until a patch is available. Additionally, restrict access to sensitive files and directories on the server to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-36123

Affected Products

Echo Sharecare

References · 5

• https://osv.dev/vulnerability/CVE-2021-36123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36123 · Security Note
• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md · Note
• https://t.me/cvenotify/17529 · Telegram Post
• https://t.me/cibsecurity/26113 · Telegram Post