Description

Kramer VIAware allows an unauthenticated user to upload arbitrary files. An attacker can exploit it to achieve remote code execution.

Remediation

Upgrade to the latest version of Kramer VIAware

References

CVE-2021-36356 Detail

CVE-2021-36356 Unauthenticated Remote Code Execution in VIAware

Related Vulnerabilities

Artifactory Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2021-41834)

Resin Application Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-2032)

MyBB Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2015-8974)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-6264)

XWiki Permissions, Privileges, and Access Controls Vulnerability (CVE-2006-7223)

Severity

Critical

Classification

CVE-2021-36356 CVE-2019-17124 CVE-2021-35064 CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Tags

Unauthenticated File Upload Code Execution Known Vulnerabilities