CVE-2021-41185CWE-22

Download file outside intended directory

High · published October 26, 2021

CVSS v3.1
8.8
EPSS
1%
Percentile
72.6
In the wild
Unconfirmed
What it is

Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users may manually apply the changes from the fix commit.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01421 · 72.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2021-10-26T14:45Z
EPSS history
Timeline
  • 26 OCT 14:45Z
    Download file outside intended directory
    cvelistv5