CVE-2021-27198

Katalog CVE

CVSS 9.8 · Critical EPSS 13,6%

Kerentanan Unrestricted Upload of File with Dangerous Type pada visualware myconnection server. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbitrary File Upload in the web service when using a myspeed/sf?filename= URI. This application is written in Java and is thus cross-platform. The Windows installation runs as SYSTEM, which means that exploitation gives one Administrator privileges on the target system.

Rincian

Terbit di NVD

26 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

13,6% peluang dieksploitasi; lebih tinggi dari 96,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://myconnectionserver.visualware.com/download.html product · advisory vendor
• https://myconnectionserver.visualware.com/support/newrelease.html release notes · advisory vendor
• http://packetstormsecurity.com/files/161571/VisualWare-MyConnection-Server-11.x-Remote-Code-Execution.html advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2021/Feb/81 mailing list · advisory pihak ketiga
• https://www.securifera.com/advisories/cve-2021-27198/ advisory pihak ketiga