Skip to main content

Cells CVE-2021-41325

MEDIUM
2021-09-30 cve@mitre.org
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 30, 2021 - 19:15 nvd
MEDIUM 6.5

DescriptionNVD

Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, such users can be granted several admin permissions via the Roles parameter.)

AnalysisAI

Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, such users can be granted several admin permissions via the Roles parameter.) Affected products include: Pydio Cells.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cells

View all
CVE-2023-32749 HIGH POC
8.8 Jun 08

Pydio Cells allows users by default to create so-called external users in order to share files with them. Rated high sev

CVE-2020-12851 HIGH POC
8.1 Jun 04

Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells

CVE-2020-12847 HIGH POC
7.2 Jun 04

Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with

CVE-2020-12850 HIGH POC
7.0 Jun 11

The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Rated high severity (CVSS 7.0)

CVE-2020-12852 MEDIUM POC
6.8 Jun 04

The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key

CVE-2023-32750 MEDIUM POC
6.5 Jun 08

Pydio Cells through 4.1.2 allows SSRF. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low

CVE-2020-12853 MEDIUM POC
6.1 Jun 04

Pydio Cells 2.0.4 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentic

CVE-2023-32751 MEDIUM POC
5.4 Jun 08

Pydio Cells through 4.1.2 allows XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low

CVE-2020-12849 MEDIUM POC
5.4 Jun 05

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user r

CVE-2020-12848 MEDIUM POC
5.4 Jun 05

In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden share

CVE-2019-12901 HIGH
8.8 Jun 20

Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files

CVE-2021-41324 MEDIUM
6.5 Sep 30

Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enu

Share

CVE-2021-41325 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy