by Kastro
Paper/Archive/CVE-2021-41566

CVE-2021-41566

Tad TadTools — Tad TadTools - Arbitrary File Upload

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 80.8.808 × 2016.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.

Affected

ProductAffectedFixed inSource
TadTools≤ 3.2.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-5170-83472-1.html