CVE-2021-20671

GROWI における不適切な入力検証

Invalid file validation on the upload feature allows a remote attacker with administrative privilege to overwrite the files on the server, which may lead to arbitrary code execution

Disclosure Date

2021/03/08

Credit

stypr (@stereotype32)

CWE

• CWE-20

Product URLs

• https://growi.org/

Reference

• https://jvn.jp/en/vu/JVNVU94889258/index.html
• https://nvd.nist.gov/vuln/detail/CVE-2021-20671
• https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/
• https://www.youtube.com/watch?v=EGxHCCsaphk