Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-42342

An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts.

Published

2021-10-14T06:15:07.037

Last Modified

2024-11-21T06:27:38.790

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-434
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application embedthis goahead ≤ 4.1.3 Yes
Application embedthis goahead < 5.1.5 Yes
References