by Kastro
Paper/Archive/CVE-2021-26617

CVE-2021-26617

Gabia Co., Ltd Firstmall — Gabia Firstmall remote code execution vulnerability

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 69.8.698 × 2014.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to execute malicious code in Firstmall via navercheckout_add function.

Affected

ProductAffectedFixed inSource
Firstmallmultilingual latest version–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
krcert (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refkrcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36469