PT-2021-3956 · Ellislab · Expressionengine

Published 2021-08-12 · Updated 2021-08-23 · CVE-2021-33199

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Expression Engine versions prior to 6.0.3

Description The issue exists due to insufficient input validation in Expression Engine. This allows a remote attacker to impact the confidentiality, integrity, and availability of protected information. The addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file names of icon.png and icon.svg.

Recommendations For versions prior to 6.0.3, update to version 6.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod.file.php module to minimize the risk of exploitation. Avoid using the input->get('file') variable in the affected API endpoint until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-04475

CVE-2021-33199

Affected Products

Expressionengine

References · 6

• https://github.com/ExpressionEngine/ExpressionEngine/compare/6.0.1...6.0.3#diff-17bcb23e5666fc2dccb79c7133e9eeb701847f67ae84fbde0a673c3fd3d109e0R508 · Patch
• https://osv.dev/vulnerability/CVE-2021-33199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33199 · Security Note
• https://bdu.fstec.ru/vul/2021-04475 · Security Note
• https://github.com/ExpressionEngine/ExpressionEngine/releases/tag/6.0.3 · Note
• https://t.me/cibsecurity/27282 · Telegram Post