PT-2022-12424 · Unknown · Opendocman

Longwayhomie · Published 2022-03-18 · Updated 2022-03-25 · CVE-2021-45834

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenDocMan version 1.4.4

Description An attacker can upload or transfer files of dangerous types to the OpenDocMan portal via the "add.php" endpoint using MIME-bypass. This may lead to arbitrary code execution or automatic processing within the product's environment.

Recommendations For OpenDocMan version 1.4.4, consider restricting access to the "add.php" endpoint to minimize the risk of exploitation until a patch is available. As a temporary workaround, restrict the upload of files to only necessary and safe types to prevent potential arbitrary code execution.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-45834

Affected Products

Opendocman

References · 7

• 🔥 https://github.com/opendocman/opendocman/issues/330 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45834 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45834 · Vendor Advisory
• https://github.com/opendocman/opendocman/issues/326 · Note
• https://github.com/opendocman/opendocman · Note
• https://t.me/cibsecurity/39194 · Telegram Post
• http://opendocman.com · Note