CVE-2021-26473 - OpenCVE

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Vembu	Bdr Suite Offsite Dr

Configuration 1 [-]

OR	cpe:2.3:a:vembu:bdr_suite::::::::
	cpe:2.3:a:vembu:offsite_dr::::::::

No data.

References

Link	Providers
https://csirt.divd.nl/2021/05/11/Vembu-zero-days/
https://csirt.divd.nl/cases/DIVD-2020-00011/
https://csirt.divd.nl/cves/CVE-2021-26473/
https://www.wbsec.nl/vembu

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-06-08T18:38:48.809397Z

Updated: 2024-09-16T22:31:08.161Z

Reserved: 2021-02-01T00:00:00

Link: CVE-2021-26473

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-06-08T19:15:08.290

Modified: 2022-04-22T19:10:57.920

Link: CVE-2021-26473

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "credits": [{"lang": "en", "value": "Discovered by Wietse Boonstra"}, {"lang": "en", "value": "Addional research by Frank Breedijk"}], "datePublic": "2021-07-07T00:00:00", "descriptions": [{"lang": "en", "value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-02-04T22:33:12", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.wbsec.nl/vembu"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://csirt.divd.nl/cves/CVE-2021-26473/"}], "source": {"advisory": "DIVD-2020-00011", "discovery": "EXTERNAL"}, "title": "Unauthenticated arbitrary file upload and command execution in Vembu products", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "DATE_PUBLIC": "2021-07-07T10:49:00.000Z", "ID": "CVE-2021-26473", "STATE": "PUBLIC", "TITLE": "Unauthenticated arbitrary file upload and command execution in Vembu products"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "Discovered by Wietse Boonstra"}, {"lang": "eng", "value": "Addional research by Frank Breedijk"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://csirt.divd.nl/cases/DIVD-2020-00011/", "refsource": "CONFIRM", "url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"}, {"name": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/", "refsource": "CONFIRM", "url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"}, {"name": "https://www.wbsec.nl/vembu", "refsource": "CONFIRM", "url": "https://www.wbsec.nl/vembu"}, {"name": "https://csirt.divd.nl/cves/CVE-2021-26473/", "refsource": "CONFIRM", "url": "https://csirt.divd.nl/cves/CVE-2021-26473/"}]}, "source": {"advisory": "DIVD-2020-00011", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:26:25.365Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.wbsec.nl/vembu"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://csirt.divd.nl/cves/CVE-2021-26473/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-26473", "datePublished": "2021-06-08T18:38:48.809397Z", "dateReserved": "2021-02-01T00:00:00", "dateUpdated": "2024-09-16T22:31:08.161Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vembu:bdr_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "D9F91BA2-195F-4A24-9403-724BD268CB56", "versionEndExcluding": "4.2.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:vembu:offsite_dr:*:*:*:*:*:*:*:*", "matchCriteriaId": "04101E71-5807-4324-9992-358362D276E4", "versionEndExcluding": "4.2.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server."}, {"lang": "es", "value": "En VembuBDR antes de 4.2.0.1 y VembuOffsiteDR antes de 4.2.0.1 la API http ubicada en /sgwebservice_o.php action logFilePath permite a un atacante escribir archivos arbitrarios en el contexto del proceso del servidor web. Estos archivos pueden entonces ser ejecutados remotamente llamando al archivo a trav\u00e9s del servidor web"}], "id": "CVE-2021-26473", "lastModified": "2022-04-22T19:10:57.920", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2021-06-08T19:15:08.290", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://csirt.divd.nl/cves/CVE-2021-26473/"}, {"source": "cve@mitre.org", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://www.wbsec.nl/vembu"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}