CVE-2021-32093

The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
VendorProductVersion
nsaemissary
5.9.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealed
https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeover
https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealed
https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeover