Bookstack CVE-2021-3915

MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2021-11-13 security@huntr.dev

File Upload Bookstack

5.7

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Nov 13, 2021 - 10:15 nvd

MEDIUM 5.7

DescriptionNVD

bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type

AnalysisAI

bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type Affected products include: Bookstackapp Bookstack.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Bookstack

View all

CVE-2021-4119 CRITICAL Act Now POC

bookstack is vulnerable to Improper Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely e

CVE-2020-26210 HIGH This Week POC

In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execut

CVE-2021-3944 MEDIUM This Month POC

bookstack is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.8), this vulnerability is re

CVE-2023-6199 MEDIUM This Month POC

Book Stack version 23.10.2 allows filtering local files on the server. Rated medium severity (CVSS 6.5), this vulnerabil

CVE-2021-3916 MEDIUM This Month POC

bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated medium

CVE-2021-3906 MEDIUM This Month POC

bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type. Rated medium severity (CVSS 6.5), this vulne

CVE-2021-3874 MEDIUM This Month POC

bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated medium

CVE-2021-3758 MEDIUM This Month POC

bookstack is vulnerable to Server-Side Request Forgery (SSRF). Rated medium severity (CVSS 6.5), this vulnerability is r

CVE-2022-0877 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3. Rated medium severity

CVE-2021-3768 MEDIUM This Month POC

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated m

CVE-2021-3767 MEDIUM This Month POC

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated m

CVE-2020-5256 HIGH This Week

BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions,

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all

CVE-2016-3088 CRITICAL POC

CVE-2021-31207 MEDIUM POC

CVE-2017-12617 HIGH POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2024-5084 CRITICAL POC

CVE-2020-36847 CRITICAL POC

CVE-2017-6090 HIGH POC

Same technique File Upload

View all

CVE-2016-3088 CRITICAL POC

CVE-2017-12617 HIGH POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2024-5084 CRITICAL POC

CVE-2016-6600 CRITICAL POC

CVE-2017-6090 HIGH POC

CVE-2015-8249 CRITICAL POC

Share

CVE-2021-3915 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy