CVE-2021-26473

CRITICAL

Vembu Bdr Suite < 4.2.0.1 - Unrestricted File Upload

Title source: rule
STIX 2.1

Description

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server.

References (4)

Core 4
Core References
Third Party Advisory x_refsource_confirm
https://csirt.divd.nl/cases/DIVD-2020-00011/
Third Party Advisory x_refsource_confirm
https://csirt.divd.nl/2021/05/11/Vembu-zero-days/
Broken Link, Third Party Advisory x_refsource_confirm
https://www.wbsec.nl/vembu
Third Party Advisory x_refsource_confirm
https://csirt.divd.nl/cves/CVE-2021-26473/

Scores

CVSS v3 9.8
EPSS 0.0074
EPSS Percentile 73.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (2)
vembu/bdr_suite < 4.2.0.1
vembu/offsite_dr < 4.2.0.1
Published Jun 08, 2021
Tracked Since Feb 18, 2026