Filerun CVE-2021-35505

HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2021-10-05 cve@mitre.org

7.2

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Oct 05, 2021 - 12:15 nvd

HIGH 7.2

DescriptionNVD

Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.

AnalysisAI

Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-74. Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary. Affected products include: Afian Filerun.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Filerun

View all

CVE-2017-14738 CRITICAL Act Now POC

FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize in

CVE-2022-30469 HIGH This Week POC

In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman&section=get&page

CVE-2021-35504 HIGH This Week POC

Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary

CVE-2018-7735 HIGH This Week POC

Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via th

CVE-2018-7734 HIGH This Week POC

Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via th

CVE-2021-35506 MEDIUM This Month POC

Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor fo

CVE-2021-35503 MEDIUM This Month POC

Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity

CVE-2019-12905 MEDIUM This Month POC

FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman&section=do&page=up URI. Rated medium severity (CVS

CVE-2022-30470 CRITICAL Act Now

In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file result

CVE-2023-28875 MEDIUM This Month POC

A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code

CVE-2019-12459 MEDIUM This Month POC

FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. Rated medium severity (CVSS 5.3), this v

CVE-2019-12458 MEDIUM This Month POC

FileRun 2019.05.21 allows css/ext-ux Directory Listing. Rated medium severity (CVSS 5.3), this vulnerability is remotely

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all

CVE-2013-2251 CRITICAL POC

CVE-2016-4010 CRITICAL POC

CVE-2015-1592 HIGH POC

CVE-2025-20281 CRITICAL POC

CVE-2015-7309 MEDIUM POC

CVE-2014-8423 CRITICAL POC

CVE-2020-8468 HIGH POC

CVE-2015-3253 CRITICAL

Same technique RCE

View all

CVE-2017-7269 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2025-53770 CRITICAL POC

CVE-2020-7961 CRITICAL POC

Share

CVE-2021-35505 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy