PT-2022-11426 · Leostream · Leostream Connection Broker

Published 2022-01-18 · Updated 2022-01-27 · CVE-2021-41550

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Leostream Connection Broker version 9.0.40.17

Description The issue allows an administrator to upload and execute Perl code.

Recommendations For Leostream Connection Broker version 9.0.40.17, consider restricting the upload functionality to prevent the execution of malicious Perl code until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-41550

Affected Products

Leostream Connection Broker

References · 7

• https://leostream.com/wp-content/uploads/2018/11/Leostream_release_notes.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41550 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41550 · Security Note
• https://leostream.com/resource/leostream-connection-broker-9-0 · Vendor Advisory
• https://t.me/cvenotify/25915 · Telegram Post
• https://t.me/cibsecurity/35706 · Telegram Post
• https://t.me/cvenotify/25592 · Telegram Post