CVE-2021-44911

{"id": "CVE-2021-44911", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2022-02-09T16:15:14.260", "references": [{"url": "https://github.com/xpressengine/xe-core/issues/2434", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities."}, {"lang": "es", "value": "XE versiones anteriores a 1.11.6, es vulnerable a una carga de archivos sin restricciones por medio del archivo modules/menu/menu.admin.controller.php. Cuando es subido el bot\u00f3n Mouse over y When selected, no se presenta restricci\u00f3n en el sufijo del archivo, lo que conlleva a que cualquier archivo se suba al directorio de archivos. Dado que .htaccess s\u00f3lo restringe el tipo de PHP, la subida de archivos de tipo HTML conlleva a vulnerabilidades de tipo XSS almacenadas"}], "lastModified": "2022-02-16T22:15:21.313", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xpressengine:xpressengine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35C2B095-1B22-40E7-97C1-23D48EA1AF29", "versionEndExcluding": "1.11.6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}