Vulnerability · Published Dec 3, 2021 · Assigned by snyk
CVE-2021-23562Arbitrary File Upload
Medium 4.2
In plain English
A medium-severity security flaw in plupload. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)1.0%top 36.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | plupload | 2.3.9 | GHSA-rp2c-jrgp-cvr8 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-PLUPLOAD-1583909 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2306663 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMOXIECODE-2306664 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2306665 x_refsource_MISC
- https://github.com/moxiecode/plupload/blob/master/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226 x_refsource_MISC
- https://github.com/moxiecode/plupload/commit/d12175d4b5fa799b994ee1bb17bfbeec55b386fb x_refsource_MISC