CVE-2021-44162CWE-22

Chain Sea Information Integration Co., Ltd ai chatbot system - Path Traversal

High · published December 20, 2021

CVSS v3.1
7.5
EPSS
2%
Percentile
77.4
In the wild
Unconfirmed
What it is

Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of special characters in URL parameters, which allows a remote attacker to download arbitrary system files without authentication.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01732 · 77.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2021-12-20T03:10Z
EPSS history
Timeline
  • 20 DEC 03:10Z
    Chain Sea Information Integration Co., Ltd ai chatbot system - Path Traversal
    cvelistv5