PT-2022-11339 · Monstra · Monstra

Wuhuaviator · Published 2022-06-15 · Updated 2022-06-24 · CVE-2021-40940

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Monstra version 3.0.4

Description The issue is related to an unrestricted file upload vulnerability. This occurs because Monstra does not filter the case of php, allowing for potential malicious file uploads.

Recommendations For Monstra version 3.0.4, consider restricting or disabling file upload functionality until a proper fix is implemented to filter and validate uploaded files, especially those with php extensions.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-40940

Affected Products

Monstra

References · 4

• 🔥 https://github.com/monstra-cms/monstra/issues/471 · Exploit
• https://osv.dev/vulnerability/CVE-2021-40940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40940 · Security Note
• https://t.me/cibsecurity/44549 · Telegram Post