PT-2021-6928 · Elcomplus · Elcomplus Smartptt

Michael Heinzl · Published 2021-04-21 · Updated 2022-05-09 · CVE-2021-43930

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Elcomplus SmartPTT (affected versions not specified)

Description The issue is related to inadequate validation of download requests in the backup and restore system, allowing malicious users to perform path traversal attacks. This could enable attackers to download arbitrary files from the system. Additionally, the vulnerability may allow remote attackers to write arbitrary files to arbitrary locations in the file system using a specially crafted HTTP request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-35

CWE-22

Related Identifiers

BDU:2022-02688

CVE-2021-43930

Affected Products

Elcomplus Smartptt

References · 8

• https://osv.dev/vulnerability/CVE-2021-43930 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43930 · Security Note
• https://bdu.fstec.ru/vul/2022-02688 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-109-04 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-109-05 · Note
• https://awesec.com/advisories/AWE-2022-048.html · Note
• https://t.me/cibsecurity/41569 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022042006 · Note