CVE-2021-23280CWE-434

Arbitrary File upload

High · published April 13, 2021

CVSS v3.1
8.0
EPSS
1%
Percentile
58.5
In the wild
Unconfirmed
What it is

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00872 · 58.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2021-04-13T18:04Z
EPSS history
Timeline
  • 13 APR 18:04Z
    Arbitrary File upload
    cvelistv5