PT-2021-23339 · Tadtools · Tadtools

Hsuan · Published 2021-10-08 · Updated 2021-10-15 · CVE-2021-41566

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TadTools (affected versions not specified)

Description The issue concerns the file extension filtering in the TadTools file upload function. This filtering failure allows remote attackers to upload any type of file and execute arbitrary code without the need for login credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-41566

Affected Products

Tadtools

References · 4

• https://osv.dev/vulnerability/CVE-2021-41566 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41566 · Security Note
• https://twcert.org.tw/tw/cp-132-5170-83472-1.html · Note
• https://t.me/cibsecurity/30262 · Telegram Post