PT-2022-12665 · Cybele · Thinfinity Virtualui

Daniel Morales · Published 2022-02-09 · Updated 2022-03-01 · CVE-2021-46354

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thinfinity VirtualUI versions 2.1.28.0 through 2.5.26.2

Description The issue affects the Addr parameter in the cmd site, allowing the vulnerable server to disclose information or increase the attack surface by sending requests to other systems. This can potentially allow the filtration of the real IP of the web server.

Recommendations For Thinfinity VirtualUI versions 2.1.28.0 through 2.5.26.2, update to version 3.0 to resolve the issue. As a temporary workaround, consider restricting access to the Addr parameter in the cmd site until a patch is available.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2021-46354

Affected Products

Thinfinity Virtualui

References · 8

• 🔥 https://exploit-db.com/exploits/50771 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46354 · Security Note
• http://thinfinity.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46354 · Vendor Advisory
• https://github.com/cybelesoft/virtualui/issues/3 · Note
• https://t.me/cvenotify/27138 · Telegram Post
• https://t.me/cibsecurity/37054 · Telegram Post
• http://packetstormsecurity.com/files/166069/Thinfinity-VirtualUI-2.5.26.2-Information-Disclosure.html · Note