Vulnerability · Published Dec 20, 2021 · Assigned by twcert
CVE-2021-441594MOSAn GCB Doctor - Unrestricted Upload of File
Critical 9.8
In plain English
A critical-severity unrestricted file upload in GCB Doctor from 4MOSAn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)3.5%top 10.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshell files without authentication and execute arbitrary code in order to perform arbitrary system operations or deny of service attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 4MOSAn | GCB Doctor | unspecified – through 20210811(2.0) |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-5395-eee40-1.html x_refsource_MISC