CVE-2021-29281

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

2.44%

Published

Jul 7, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434

Affected Products (1)

gfi · archiver (up to 15.2)vulnerable

References (10)

https://aminbohio.com/gfi-mail-archiver-15-1-telerik-ui-component-arbitrary-file-upload-unauthenticated-exploit/

ExploitThird Party Advisory

https://cwe.mitre.org/data/definitions/434.html

Technical DescriptionThird Party Advisory

https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

Technical DescriptionThird Party Advisory

https://www.exploit-db.com/exploits/50181

ExploitThird Party AdvisoryVDB Entry

https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiver

Product

https://aminbohio.com/gfi-mail-archiver-15-1-telerik-ui-component-arbitrary-file-upload-unauthenticated-exploit/

ExploitThird Party Advisory

https://cwe.mitre.org/data/definitions/434.html

Technical DescriptionThird Party Advisory

https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

Technical DescriptionThird Party Advisory

https://www.exploit-db.com/exploits/50181

ExploitThird Party AdvisoryVDB Entry

https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiver

Product

KEV Catalog EPSS Scores Vendors All CVEs