CVE-2021-35380

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download (http://url:port/file?valore).

7.5

CVSS

39.0%

EPSS (exploit prob.)

99th

EPSS percentile

2022-02-15

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
solari	termtalk_server	3.24.0.2

Check a specific version with /api/v1/cve/match.

References

https://www.exploit-db.com/exploits/50638
https://www.swascan.com/it/security-blog/
https://www.swascan.com/solari-di-udine/
https://www.exploit-db.com/exploits/50638
https://www.swascan.com/it/security-blog/
https://www.swascan.com/solari-di-udine/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-35380