nvd-json-data-feeds/CVE-2021/CVE-2021-342xx/CVE-2021-34257.json

{
  "id": "CVE-2021-34257",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2022-03-31T16:15:07.513",
  "lastModified": "2022-04-08T02:07:15.033",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de Ejecuci\u00f3n de C\u00f3digo Remota (RCE) existen en WPanel versiones 4 4.3.1 y anteriores, por medio de una carga de archivos PHP maliciosos en (1) la imagen del avatar del panel de control, (2) la imagen de la carpeta de publicaciones, (3) la imagen de la carpeta de p\u00e1ginas y (4) la imagen de la carpeta de la galer\u00eda"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:wpanel_cms_project:wpanel_cms:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "4.3.1",
              "matchCriteriaId": "AE16E763-73A6-4CF7-AB34-27FB6FDD1380"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Sentinal920/WPanel4-Authenticated-RCE",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://latestpcsolution.wordpress.com/2021/06/05/wpanel4-cms-authenticated-rce/",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}