PT-2021-21267 · Yellowfin · Yellowfin

Cyberaz0R + 1 · Published 2021-10-14 · Updated 2024-05-14 · CVE-2021-36389

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Yellowfin versions prior to 9.6.1

Description The issue allows enumeration and download of uploaded images through an Insecure Direct Object Reference vulnerability. This can be exploited by sending a specially crafted HTTP GET request to the "MIImage.i4" page.

Recommendations For versions prior to 9.6.1, update to version 9.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "MIImage.i4" page to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2021-36389

Affected Products

Yellowfin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-36389 · Security Note
• https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36389 · Vendor Advisory
• https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.md · Note
• https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities · Note
• https://t.me/cibsecurity/30594 · Telegram Post
• https://t.me/cvenotify/79772 · Telegram Post
• http://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.html · Note
• http://seclists.org/fulldisclosure/2021/Oct/15 · Note