CVE-2021-35244

Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6

Medium · published December 20, 2021

CVSS v3.1
6.8
EPSS
6%
Percentile
93.3
In the wild
Unconfirmed
What it is

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.05956 · 93.3th percentile
Published
2021-12-20T20:08Z
EPSS history
Timeline
  • 20 DEC 20:08Z
    Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6
    cvelistv5