CVE-2021-26612CWE-20

tobesoft Nexacro platform arbitrary file creation vulnerability

High · published November 30, 2021

CVSS v3.1
8.1
EPSS
1%
Percentile
68.0
In the wild
Unconfirmed
What it is

An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01203 · 68.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2021-11-30T18:39Z
EPSS history
Timeline
  • 30 NOV 18:39Z
    tobesoft Nexacro platform arbitrary file creation vulnerability
    cvelistv5