PT-2021-3950 · Unknown · Ctparental

Published 2021-08-10 · Updated 2021-08-13 · CVE-2021-37367

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CTparental versions prior to 4.45.07

Description The issue is related to a code execution vulnerability in the CTparental admin panel. Specifically, the file "bl categories help.php" is vulnerable to directory traversal, allowing an attacker to create a file containing scripts and execute arbitrary commands. This vulnerability exists due to incorrect restriction of the directory path name with limited access.

Recommendations For CTparental versions prior to 4.45.07, update to version 4.45.07 or later to resolve the issue. As a temporary workaround, consider restricting access to the "bl categories help.php" file to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-04468

CVE-2021-37367

Affected Products

Ctparental

References · 7

• https://osv.dev/vulnerability/CVE-2021-37367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37367 · Security Note
• https://bdu.fstec.ru/vul/2021-04468 · Security Note
• https://gitlab.com/marsat/CTparental · Note
• https://t.me/cibsecurity/27085 · Telegram Post
• https://gist.github.com/securylight/092ba96a660e07ad76f2a380c2eaa75a · Note
• https://t.me/cvenotify/19322 · Telegram Post