2021-09-06 11:21:29 +00:00
id : CVE-2021-20114
info :
name : TCExam <= 14.8.1 Exposure of Sensitive Information to an Unauthorized Actor
2021-09-06 12:18:01 +00:00
author : push4d
2021-09-06 11:21:29 +00:00
severity : high
2021-09-06 12:00:51 +00:00
description : When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which included sensitive database backup files.
reference :
- https://es-la.tenable.com/security/research/tra-2021-32?tns_redirect=true
- https://nvd.nist.gov/vuln/detail/CVE-2021-20114
tags : cve,cve2021,tcexam,disclosure
2021-09-06 11:21:29 +00:00
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score : 7.50
cve-id : CVE-2021-20114
cwe-id : CWE-200
2021-09-06 11:21:29 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/cache/backup/"
2021-09-06 12:00:51 +00:00
matchers-condition : and
2021-09-06 11:21:29 +00:00
matchers :
2021-09-06 12:00:51 +00:00
- type : word
words :
- "Index of /cache/backup"
- "Parent Directory"
- ".sql.gz"
condition : and
2021-09-06 11:21:29 +00:00
- type : status
status :
2021-09-06 12:00:51 +00:00
- 200
