by Kastro
Paper/Archive/CVE-2021-20736

CVE-2021-20736

WESEEK, Inc. GROWI — NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored i…

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 70.6.706 × 2014.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.

Affected

ProductAffectedFixed inSource
GROWIversions prior to v4.2.20–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refweseek.co.jp/security/2021/06/14/vulnerability/growi-nosql-ingectionrefjvn.jp/en/jp/JVN95457785/index.html