PT-2021-23003 · Unknown · Projectsend

Kietna-68 · Published 2021-10-11 · Updated 2021-10-16 · CVE-2021-40886

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Projectsend version r1295

Description The issue allows a user with the Uploader role to bypass fileName sanitization by setting the value of the chunks parameter to 2, potentially leading to a directory traversal vulnerability.

Recommendations For Projectsend version r1295, as a temporary workaround, consider restricting the chunks parameter to prevent it from being set to 2 until a patch is available. Avoid using the chunks parameter with a value of 2 in the affected functionality to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-40886

Affected Products

Projectsend

References · 5

• 🔥 https://github.com/projectsend/projectsend/issues/993 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-40886 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40886 · Vendor Advisory
• https://t.me/cvenotify/22255 · Telegram Post
• https://t.me/cibsecurity/30323 · Telegram Post