Vulnerability · Published Dec 14, 2021 · Assigned by GitHub_M

CVE-2021-43829Unrestricted Upload of Files in Patrowl

High 7.4

In plain English

A high-severity unrestricted file upload in PatrowlManager from Patrowl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 59.2% (higher than 99.1% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)59.2%top 0.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature. This vulnerability is capable of uploading dangerous type of file to server leading to XSS attacks and potentially other forms of code injection. Users are advised to update to 1.7.7 as soon as possible. There are no known workarounds for this issue.

Affected products (as reported)

Vendor	Product	Versions
Patrowl	PatrowlManager	< 1.7.7

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References

https://github.com/Patrowl/PatrowlManager/security/advisories/GHSA-5hc9-6hq4-2xfx x_refsource_CONFIRM
https://github.com/Patrowl/PatrowlManager/commit/2287c9715d2e7ef11b44bb0ad4a57727654f2203 x_refsource_MISC
https://huntr.dev/bounties/17324785-f83a-4058-ac40-03f2bfa16399/ x_refsource_MISC