CVE-2021-43829: patrowlmanager

csirt@kutim:~/threat-intel/cve/CVE-2021-43829

CVSS 8.8 · High EPSS 59,2%

Kerentanan Unrestricted Upload of File with Dangerous Type pada patrowlmanager. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature. This vulnerability is capable of uploading dangerous type of file to server leading to XSS attacks and potentially other forms of code injection. Users are advised to update to 1.7.7 as soon as possible. There are no known workarounds for this issue.

Rincian

Terbit di NVD: 14 Desember 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 59,2% peluang dieksploitasi; lebih tinggi dari 99,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
patrowl	patrowlmanager	Semua versi sebelum 1.7.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Patrowl/PatrowlManager/commit/2287c9715d2e7ef11b44bb0ad4a57727654f2203 patch · advisory pihak ketiga
https://huntr.dev/bounties/17324785-f83a-4058-ac40-03f2bfa16399/ exploit · patch · advisory pihak ketiga
https://github.com/Patrowl/PatrowlManager/security/advisories/GHSA-5hc9-6hq4-2xfx advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.