Vulnerability · Published May 24, 2022 · Assigned by icscert
CVE-2021-32964Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel
Medium 6.5
In plain English
A medium-severity security flaw in Web Server (webserver.dll) from AGG Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.8%top 41.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The AGG Software Web Server version 4.0.40.1014 and prior is vulnerable to a path traversal attack, which may allow an attacker to read arbitrary files from the file system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AGG Software | Web Server (webserver.dll) | All – through v4.0.40.1014 |
Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-161-02 x_refsource_MISC