Firefly Iii CVE-2021-3846

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2021-10-19 security@huntr.dev

File Upload Firefly Iii

8.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Oct 19, 2021 - 13:15 nvd

HIGH 8.8

DescriptionNVD

firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type

AnalysisAI

firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type Affected products include: Firefly-Iii Firefly Iii.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Firefly Iii

View all

CVE-2021-3901 HIGH This Week POC

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-3819 HIGH This Week POC

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-3663 HIGH This Week POC

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts. Rated high severity (CVSS 7.5),

CVE-2023-0298 MEDIUM This Month POC

Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0. Rated medium severity (CVSS 6.5), t

CVE-2021-3900 MEDIUM This Month POC

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is

CVE-2021-3728 MEDIUM This Month POC

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is

CVE-2019-14667 MEDIUM This Month POC

Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in

CVE-2023-1788 CRITICAL Act Now

Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6. Rated critical severity (CVSS 9

CVE-2023-1789 CRITICAL Act Now

Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0. Rated critical severity (CVSS 9.8

CVE-2021-3851 MEDIUM This Month POC

firefly-iii is vulnerable to URL Redirection to Untrusted Site. Rated medium severity (CVSS 5.4), this vulnerability is

CVE-2019-14672 MEDIUM This Month POC

Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability na

CVE-2019-14670 MEDIUM This Month POC

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name fi

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all

CVE-2016-3088 CRITICAL POC

CVE-2021-31207 MEDIUM POC

CVE-2017-12617 HIGH POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2024-5084 CRITICAL POC

CVE-2020-36847 CRITICAL POC

CVE-2017-6090 HIGH POC

Same technique File Upload

View all

CVE-2016-3088 CRITICAL POC

CVE-2017-12617 HIGH POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2024-5084 CRITICAL POC

CVE-2016-6600 CRITICAL POC

CVE-2017-6090 HIGH POC

CVE-2015-8249 CRITICAL POC

Share

CVE-2021-3846 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy