VulnerabilityModified
CVE-2021-41185
An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory.
MEDIUM 6.5EPSS 1.42%
Does this matter?
Lower severity and a low EPSS score (1.42%). Track it; it rarely justifies an emergency change on its own.
Description
Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users may manually apply the changes from the fix commit.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.42% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- mycodo project/mycodo
- Source
- security-advisories@github.com
References
- https://github.com/kizniche/Mycodo/commit/23ac5dd422029c2b6ae1701a3599b6d41b66a6a9Patch, Third Party Advisory
- https://github.com/kizniche/Mycodo/issues/1105Issue Tracking, Third Party Advisory
- https://github.com/kizniche/Mycodo/releases/tag/v8.12.7Release Notes, Third Party Advisory
- https://github.com/kizniche/Mycodo/security/advisories/GHSA-252r-94ph-m229Patch, Third Party Advisory
- https://github.com/kizniche/Mycodo/commit/23ac5dd422029c2b6ae1701a3599b6d41b66a6a9Patch, Third Party Advisory
- https://github.com/kizniche/Mycodo/issues/1105Issue Tracking, Third Party Advisory
- https://github.com/kizniche/Mycodo/releases/tag/v8.12.7Release Notes, Third Party Advisory
- https://github.com/kizniche/Mycodo/security/advisories/GHSA-252r-94ph-m229Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.