CVE-2021-27198
critical · 9.8An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbitrary File Upload in the web service when using a myspeed/sf?filename= URI. This application is written in Java and is thus cross-platform. The Windows installation runs as SYSTEM, which means that exploitation gives one Administrator privileges on the target system.
9.8
CVSS
13.6%
EPSS (exploit prob.)
96th
EPSS percentile
2021-02-26
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| visualware | myconnection_server | < 11.1a |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/161571/VisualWare-MyConnection-Server-11.x-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2021/Feb/81
- https://myconnectionserver.visualware.com/download.html
- https://myconnectionserver.visualware.com/support/newrelease.html
- https://www.securifera.com/advisories/cve-2021-27198/
- http://packetstormsecurity.com/files/161571/VisualWare-MyConnection-Server-11.x-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2021/Feb/81
- https://myconnectionserver.visualware.com/download.html
- https://myconnectionserver.visualware.com/support/newrelease.html
- https://www.securifera.com/advisories/cve-2021-27198/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-27198