cvelist/2021/43xxx/CVE-2021-43930.json

{
    "CVE_data_meta": {
        "ASSIGNER": "ics-cert@hq.dhs.gov",
        "ID": "CVE-2021-43930",
        "STATE": "PUBLIC",
        "TITLE": "Elcomplus SmartPtt Path Traversal"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "product": {
                        "product_data": [
                            {
                                "product_name": "SmartPTT",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "=",
                                            "version_value": "1.1"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name": "Elcomplus"
                }
            ]
        }
    },
    "credit": [
        {
            "lang": "eng",
            "value": "Michael Heinzl reported these vulnerabilities to CISA"
        }
    ],
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system."
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.0.9"
    },
    "impact": {
        "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04",
                "refsource": "CONFIRM",
                "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-04"
            }
        ]
    },
    "solution": [
        {
            "lang": "eng",
            "value": "Elcomplus has released an update to fix these vulnerabilities and recommends users upgrade to Version 2.3.4 or later.\n\nFor more information, please contact Elcomplus support."
        }
    ],
    "source": {
        "advisory": "ICSA-22-109-04",
        "discovery": "UNKNOWN"
    }
}