CVE-2021-44663
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
24/02/2022
Last modified:
03/03/2022
Description
A Remote Code Execution (RCE) vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Base Score 2.0
7.50
Severity 2.0
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:nottingham.ac:xerte_online_toolkits:*:*:*:*:*:*:*:* | 3.8.4 (including) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://github.com/thexerteproject/xerteonlinetoolkits/commit/694a591b5ab7f634f036afaac10397cf3677a98c
- https://riklutz.nl/2021/10/30/unauthenticated-file-upload-to-remote-code-execution-in-xerte/
- https://www.xerte.org.uk/index.php/en/news/blog/80-news/336-xerte-3-8-5-important-security-update-now-available