« Volver al listado

CVE-2021-42839

Estado: ModificadaAlta (8.8)—

Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upload malicious script and execute arbitrary code to control the system or interrupt services.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vice — Webopac

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-42839",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "Grand Vice info Co.",
          "product": "webopac7",
          "versions": [
            {
              "status": "affected",
              "version": "7.1.20160701"
            },
            {
              "status": "affected",
              "version": "1.8.20160701"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-15T10:15:07.920",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-5288-9d546-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-5288-9d546-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upload malicious script and execute arbitrary code to control the system or interrupt services."
    },
    {
      "lang": "es",
      "value": "La función file upload de Grand Vice info Co. webopac7 falla al filtrar caracteres especiales. Mientras es iniciada la sesión con el permiso del usuario general, atacantes remotos pueden cargar un script malicioso y ejecutar código arbitrario para controlar el sistema o interrumpir los servicios"
    }
  ],
  "lastModified": "2026-06-17T04:10:11.440",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vice:webopac:1.8.20160701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB26E8B5-3741-411B-AAF5-D9686066E1B5"
            },
            {
              "criteria": "cpe:2.3:a:vice:webopac:7.1.20160701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DDE0E5E-7C6E-46A7-ABCE-BE94BC2A480C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}