PT-2023-12408 · Unknown · Eprintsug Ulcc-Core

Published 2023-01-05 · Updated 2024-05-17 · CVE-2021-4304

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eprintsug ulcc-core (affected versions not specified)

Description A critical issue was found in the file cgi/toolbox/toolbox, where the manipulation of the password argument leads to command injection. This issue can be exploited remotely.

Recommendations Apply the patch 811edaae81eb044891594f00062a828f51b22cb1 to fix this issue. As a temporary workaround, consider restricting access to the cgi/toolbox/toolbox file to minimize the risk of exploitation. Avoid using the password argument in the affected functionality until the issue is resolved.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-4304

Affected Products

Eprintsug Ulcc-Core

References · 5

• https://github.com/eprintsug/ulcc-core/commit/811edaae81eb044891594f00062a828f51b22cb1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-4304 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4304 · Vendor Advisory
• https://vuldb.com/?ctiid.217447 · Note
• https://vuldb.com/?id.217447 · Note