PT-2022-12280 · Taocms · Taocms

7Wkajko · Published 2022-02-04 · Updated 2022-02-08 · CVE-2021-44983

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions taocms version 3.0.1

Description The issue is related to an Arbitrary file download vulnerability. It occurs after logging in to the background, specifically at the File Management column.

Recommendations For taocms version 3.0.1, consider restricting access to the File Management column to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2021-44983

Affected Products

Taocms

References · 6

• 🔥 https://github.com/taogogo/taocms/issues/10 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-44983 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44983 · Vendor Advisory
• https://t.me/cibsecurity/36853 · Telegram Post
• https://t.me/cvenotify/26276 · Telegram Post
• https://t.me/cvenotify/26262 · Telegram Post