VulnerabilityModified
CVE-2021-38697
SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution.
CRITICAL 9.8EPSS 2.69%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.69%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.69% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- softvibe/saraban
- Source
- cve@mitre.org
References
- http://www.infoma.net/index.php/saraban/Product
- https://orangeo.tech/post/2021/12/24/First-CVEs.htmlExploit, Third Party Advisory, URL Repurposed
- https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=USProduct
- https://sawatdee.github.io/post/2021/12/24/First-CVEs.htmlExploit, Third Party Advisory
- http://www.infoma.net/index.php/saraban/Product
- https://orangeo.tech/post/2021/12/24/First-CVEs.htmlExploit, Third Party Advisory, URL Repurposed
- https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=USProduct
- https://sawatdee.github.io/post/2021/12/24/First-CVEs.htmlExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.