OpenCVE

When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Windows
Xpressengine	Xpressengine

Configuration 1 [-]

AND

cpe:2.3:a:xpressengine:xpressengine:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67125

History

No history.

MITRE

Status: PUBLISHED

Assigner: krcert

Published: 2023-01-20T00:00:00

Updated: 2024-08-03T20:26:25.639Z

Reserved: 2021-02-03T00:00:00

Link: CVE-2021-26642

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-01-20T17:15:10.300

Modified: 2024-11-21T05:56:38.840

Link: CVE-2021-26642

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xpressengine:xpressengine:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7B83BE4-8720-4FAE-BBD5-C2C2F5BC0F1E", "versionEndExcluding": "3.0.14", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running."}, {"lang": "es", "value": "Al cargar un archivo de imagen en un tablero de anuncios desarrollado con XpressEngine, se presenta una vulnerabilidad en la que se puede cargar un archivo arbitrario debido a una verificaci\u00f3n insuficiente del archivo. Un atacante remoto puede utilizar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el servidor donde se ejecuta el tabl\u00f3n de anuncios."}], "id": "CVE-2021-26642", "lastModified": "2024-11-21T05:56:38.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "vuln@krcert.or.kr", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-20T17:15:10.300", "references": [{"source": "vuln@krcert.or.kr", "tags": ["Third Party Advisory"], "url": "https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67125"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67125"}], "sourceIdentifier": "vuln@krcert.or.kr", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "vuln@krcert.or.kr", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}