VulnerabilityModified

CVE-2021-36471

Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html, /admin/index3.html URIs.

CRITICAL 9.8EPSS 1.75%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.75%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html, /admin/index3.html URIs. Note: AdminLTE developers dispute that this a weakness with AdminLTE and is instead a misconfiguration error on various websites by the website developers.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.75% probability · 77th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: adminlte.io/adminlte
Source: cve@mitre.org

References

https://gist.github.com/cybersaki/31ffe679a5552c1047164e3a5b01c2fdThird Party Advisory
https://github.com/ColorlibHQ/AdminLTE/issues/4948
https://gist.github.com/cybersaki/31ffe679a5552c1047164e3a5b01c2fdThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.