CVE-2021-40875

Katalog CVE

CVSS 7.5 · High EPSS 47,5%

Kerentanan Direct Request ('Forced Browsing') pada gurock testrail. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The corresponding file paths can be tested, and in some cases, result in the disclosure of hardcoded credentials, API keys, or other sensitive data.

Rincian

Terbit di NVD

22 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-425: Direct Request ('Forced Browsing')

EPSS (30 hari)

47,5% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.gurock.com/testrail/tour/enterprise-edition product · advisory vendor
• http://packetstormsecurity.com/files/164270/Gurock-Testrail-7.2.0.3014-Improper-Access-Control.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/SakuraSamuraii/derailed advisory pihak ketiga
• https://johnjhacking.com/blog/cve-2021-40875/ exploit · advisory pihak ketiga