CVE-2021-42342

critical · 9.8

An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts.

9.8

CVSS

59.5%

EPSS (exploit prob.)

99th

EPSS percentile

2021-10-14

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
embedthis	goahead	>= 4.0.0, <= 4.1.3
embedthis	goahead	>= 5.0.0, < 5.1.5

Check a specific version with /api/v1/cve/match.

References

https://github.com/embedthis/goahead/issues/305
https://github.com/embedthis/goahead/issues/305

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-42342