Vulnerability · Published Dec 20, 2021 · Assigned by twcert
CVE-2021-44164Chain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File Upload
Critical 9.8
In plain English
A critical-severity unrestricted file upload in ai chatbot system from Chain Sea Information Integration Co., Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.1%top 18.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or terminate service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Chain Sea Information Integration Co., Ltd | ai chatbot system | see references |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-5400-c31d1-1.html x_refsource_MISC