CVE-2021-40870

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
VendorProductVersion
aviatrixcontroller
6.2 ≤
𝑥
< 6.2.2043
aviatrixcontroller
6.3 ≤
𝑥
< 6.3.2490
aviatrixcontroller
6.4 ≤
𝑥
< 6.4.2838
aviatrixcontroller
6.5 ≤
𝑥
< 6.5.1922
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html
https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021
https://wearetradecraft.com/advisories/tc-2021-0002/
http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html
https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021
https://wearetradecraft.com/advisories/tc-2021-0002/