Search
Find a vulnerability
Search criteria
8 vulnerabilities found for offsite_dr by vembu
CVE-2021-26474 (GCVE-0-2021-26474)
Vulnerability from nvd – Published: 2021-06-08 18:39 – Updated: 2024-09-16 18:34
VLAI
Title
UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS
Summary
Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)
Severity
8.6 (High)
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/cases/DIVD-2020-00011/ | x_refsource_CONFIRM |
| https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ | x_refsource_CONFIRM |
| https://www.wbsec.nl/vembu | x_refsource_CONFIRM |
| https://csirt.divd.nl/cves/CVE-2021-26474/ | x_refsource_CONFIRM |
Date Public
2021-07-07 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:26:25.409Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26474/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "en",
"value": "Addional research by Frank Breedijk"
}
],
"datePublic": "2021-07-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:33:13.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26474/"
}
],
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
},
"title": "UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_PUBLIC": "2021-07-07T10:49:00.000Z",
"ID": "CVE-2021-26474",
"STATE": "PUBLIC",
"TITLE": "UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "eng",
"value": "Addional research by Frank Breedijk"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://csirt.divd.nl/cases/DIVD-2020-00011/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"name": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"name": "https://www.wbsec.nl/vembu",
"refsource": "CONFIRM",
"url": "https://www.wbsec.nl/vembu"
},
{
"name": "https://csirt.divd.nl/cves/CVE-2021-26474/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cves/CVE-2021-26474/"
}
]
},
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-26474",
"datePublished": "2021-06-08T18:39:55.493Z",
"dateReserved": "2021-02-01T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:34:03.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-26473 (GCVE-0-2021-26473)
Vulnerability from nvd – Published: 2021-06-08 18:38 – Updated: 2024-09-16 22:31
VLAI
Title
Unauthenticated arbitrary file upload and command execution in Vembu products
Summary
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server.
Severity
9.8 (Critical)
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/cases/DIVD-2020-00011/ | x_refsource_CONFIRM |
| https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ | x_refsource_CONFIRM |
| https://www.wbsec.nl/vembu | x_refsource_CONFIRM |
| https://csirt.divd.nl/cves/CVE-2021-26473/ | x_refsource_CONFIRM |
Date Public
2021-07-07 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:26:25.365Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26473/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "en",
"value": "Addional research by Frank Breedijk"
}
],
"datePublic": "2021-07-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:33:12.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26473/"
}
],
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated arbitrary file upload and command execution in Vembu products",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_PUBLIC": "2021-07-07T10:49:00.000Z",
"ID": "CVE-2021-26473",
"STATE": "PUBLIC",
"TITLE": "Unauthenticated arbitrary file upload and command execution in Vembu products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "eng",
"value": "Addional research by Frank Breedijk"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://csirt.divd.nl/cases/DIVD-2020-00011/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"name": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"name": "https://www.wbsec.nl/vembu",
"refsource": "CONFIRM",
"url": "https://www.wbsec.nl/vembu"
},
{
"name": "https://csirt.divd.nl/cves/CVE-2021-26473/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cves/CVE-2021-26473/"
}
]
},
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-26473",
"datePublished": "2021-06-08T18:38:48.809Z",
"dateReserved": "2021-02-01T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:31:08.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-26472 (GCVE-0-2021-26472)
Vulnerability from nvd – Published: 2021-06-08 18:37 – Updated: 2024-09-16 22:08
VLAI
Title
Unauthenticated remote command execution with SYSTEM privileges in Vembu products
Summary
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges.
Severity
10 (Critical)
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/cases/DIVD-2020-00011/ | x_refsource_CONFIRM |
| https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ | x_refsource_CONFIRM |
| https://www.wbsec.nl/vembu | x_refsource_CONFIRM |
| https://csirt.divd.nl/cves/CVE-2021-26472/ | x_refsource_CONFIRM |
Date Public
2021-07-07 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:26:25.398Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26472/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "en",
"value": "Addional research by Frank Breedijk"
}
],
"datePublic": "2021-07-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:33:10.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26472/"
}
],
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated remote command execution with SYSTEM privileges in Vembu products",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_PUBLIC": "2021-07-07T10:49:00.000Z",
"ID": "CVE-2021-26472",
"STATE": "PUBLIC",
"TITLE": "Unauthenticated remote command execution with SYSTEM privileges in Vembu products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "eng",
"value": "Addional research by Frank Breedijk"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://csirt.divd.nl/cases/DIVD-2020-00011/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"name": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"name": "https://www.wbsec.nl/vembu",
"refsource": "CONFIRM",
"url": "https://www.wbsec.nl/vembu"
},
{
"name": "https://csirt.divd.nl/cves/CVE-2021-26472/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cves/CVE-2021-26472/"
}
]
},
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-26472",
"datePublished": "2021-06-08T18:37:29.497Z",
"dateReserved": "2021-02-01T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:08:25.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-26471 (GCVE-0-2021-26471)
Vulnerability from nvd – Published: 2021-06-08 18:36 – Updated: 2024-09-16 16:22
VLAI
Title
Unauthenticated remote command execution in Vembu products
Summary
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands.
Severity
9.8 (Critical)
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/cves/CVE-2021-26471/ | x_refsource_CONFIRM |
| https://csirt.divd.nl/cases/DIVD-2020-00011/ | x_refsource_CONFIRM |
| https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ | x_refsource_CONFIRM |
| https://www.wbsec.nl/vembu | x_refsource_CONFIRM |
Date Public
2021-07-07 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:26:25.306Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26471/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.wbsec.nl/vembu"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "en",
"value": "Addional research by Frank Breedijk"
}
],
"datePublic": "2021-07-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:33:09.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26471/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.wbsec.nl/vembu"
}
],
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated remote command execution in Vembu products",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_PUBLIC": "2021-07-07T10:49:00.000Z",
"ID": "CVE-2021-26471",
"STATE": "PUBLIC",
"TITLE": "Unauthenticated remote command execution in Vembu products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "eng",
"value": "Addional research by Frank Breedijk"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://csirt.divd.nl/cves/CVE-2021-26471/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cves/CVE-2021-26471/"
},
{
"name": "https://csirt.divd.nl/cases/DIVD-2020-00011/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"name": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"name": "https://www.wbsec.nl/vembu",
"refsource": "CONFIRM",
"url": "https://www.wbsec.nl/vembu"
}
]
},
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-26471",
"datePublished": "2021-06-08T18:36:14.329Z",
"dateReserved": "2021-02-01T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:22:33.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-26474 (GCVE-0-2021-26474)
Vulnerability from cvelistv5 – Published: 2021-06-08 18:39 – Updated: 2024-09-16 18:34
VLAI
Title
UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS
Summary
Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)
Severity
8.6 (High)
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/cases/DIVD-2020-00011/ | x_refsource_CONFIRM |
| https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ | x_refsource_CONFIRM |
| https://www.wbsec.nl/vembu | x_refsource_CONFIRM |
| https://csirt.divd.nl/cves/CVE-2021-26474/ | x_refsource_CONFIRM |
Date Public
2021-07-07 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:26:25.409Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26474/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "en",
"value": "Addional research by Frank Breedijk"
}
],
"datePublic": "2021-07-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:33:13.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26474/"
}
],
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
},
"title": "UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_PUBLIC": "2021-07-07T10:49:00.000Z",
"ID": "CVE-2021-26474",
"STATE": "PUBLIC",
"TITLE": "UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "eng",
"value": "Addional research by Frank Breedijk"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.)"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://csirt.divd.nl/cases/DIVD-2020-00011/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"name": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"name": "https://www.wbsec.nl/vembu",
"refsource": "CONFIRM",
"url": "https://www.wbsec.nl/vembu"
},
{
"name": "https://csirt.divd.nl/cves/CVE-2021-26474/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cves/CVE-2021-26474/"
}
]
},
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-26474",
"datePublished": "2021-06-08T18:39:55.493Z",
"dateReserved": "2021-02-01T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:34:03.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-26473 (GCVE-0-2021-26473)
Vulnerability from cvelistv5 – Published: 2021-06-08 18:38 – Updated: 2024-09-16 22:31
VLAI
Title
Unauthenticated arbitrary file upload and command execution in Vembu products
Summary
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server.
Severity
9.8 (Critical)
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/cases/DIVD-2020-00011/ | x_refsource_CONFIRM |
| https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ | x_refsource_CONFIRM |
| https://www.wbsec.nl/vembu | x_refsource_CONFIRM |
| https://csirt.divd.nl/cves/CVE-2021-26473/ | x_refsource_CONFIRM |
Date Public
2021-07-07 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:26:25.365Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26473/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "en",
"value": "Addional research by Frank Breedijk"
}
],
"datePublic": "2021-07-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:33:12.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26473/"
}
],
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated arbitrary file upload and command execution in Vembu products",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_PUBLIC": "2021-07-07T10:49:00.000Z",
"ID": "CVE-2021-26473",
"STATE": "PUBLIC",
"TITLE": "Unauthenticated arbitrary file upload and command execution in Vembu products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "eng",
"value": "Addional research by Frank Breedijk"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://csirt.divd.nl/cases/DIVD-2020-00011/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"name": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"name": "https://www.wbsec.nl/vembu",
"refsource": "CONFIRM",
"url": "https://www.wbsec.nl/vembu"
},
{
"name": "https://csirt.divd.nl/cves/CVE-2021-26473/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cves/CVE-2021-26473/"
}
]
},
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-26473",
"datePublished": "2021-06-08T18:38:48.809Z",
"dateReserved": "2021-02-01T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:31:08.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-26472 (GCVE-0-2021-26472)
Vulnerability from cvelistv5 – Published: 2021-06-08 18:37 – Updated: 2024-09-16 22:08
VLAI
Title
Unauthenticated remote command execution with SYSTEM privileges in Vembu products
Summary
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges.
Severity
10 (Critical)
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/cases/DIVD-2020-00011/ | x_refsource_CONFIRM |
| https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ | x_refsource_CONFIRM |
| https://www.wbsec.nl/vembu | x_refsource_CONFIRM |
| https://csirt.divd.nl/cves/CVE-2021-26472/ | x_refsource_CONFIRM |
Date Public
2021-07-07 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:26:25.398Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26472/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "en",
"value": "Addional research by Frank Breedijk"
}
],
"datePublic": "2021-07-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:33:10.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.wbsec.nl/vembu"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26472/"
}
],
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated remote command execution with SYSTEM privileges in Vembu products",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_PUBLIC": "2021-07-07T10:49:00.000Z",
"ID": "CVE-2021-26472",
"STATE": "PUBLIC",
"TITLE": "Unauthenticated remote command execution with SYSTEM privileges in Vembu products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "eng",
"value": "Addional research by Frank Breedijk"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://csirt.divd.nl/cases/DIVD-2020-00011/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"name": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"name": "https://www.wbsec.nl/vembu",
"refsource": "CONFIRM",
"url": "https://www.wbsec.nl/vembu"
},
{
"name": "https://csirt.divd.nl/cves/CVE-2021-26472/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cves/CVE-2021-26472/"
}
]
},
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-26472",
"datePublished": "2021-06-08T18:37:29.497Z",
"dateReserved": "2021-02-01T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:08:25.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-26471 (GCVE-0-2021-26471)
Vulnerability from cvelistv5 – Published: 2021-06-08 18:36 – Updated: 2024-09-16 16:22
VLAI
Title
Unauthenticated remote command execution in Vembu products
Summary
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands.
Severity
9.8 (Critical)
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/cves/CVE-2021-26471/ | x_refsource_CONFIRM |
| https://csirt.divd.nl/cases/DIVD-2020-00011/ | x_refsource_CONFIRM |
| https://csirt.divd.nl/2021/05/11/Vembu-zero-days/ | x_refsource_CONFIRM |
| https://www.wbsec.nl/vembu | x_refsource_CONFIRM |
Date Public
2021-07-07 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T20:26:25.306Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26471/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.wbsec.nl/vembu"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "en",
"value": "Addional research by Frank Breedijk"
}
],
"datePublic": "2021-07-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:33:09.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cves/CVE-2021-26471/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.wbsec.nl/vembu"
}
],
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated remote command execution in Vembu products",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_PUBLIC": "2021-07-07T10:49:00.000Z",
"ID": "CVE-2021-26471",
"STATE": "PUBLIC",
"TITLE": "Unauthenticated remote command execution in Vembu products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Discovered by Wietse Boonstra"
},
{
"lang": "eng",
"value": "Addional research by Frank Breedijk"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://csirt.divd.nl/cves/CVE-2021-26471/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cves/CVE-2021-26471/"
},
{
"name": "https://csirt.divd.nl/cases/DIVD-2020-00011/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/cases/DIVD-2020-00011/"
},
{
"name": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/",
"refsource": "CONFIRM",
"url": "https://csirt.divd.nl/2021/05/11/Vembu-zero-days/"
},
{
"name": "https://www.wbsec.nl/vembu",
"refsource": "CONFIRM",
"url": "https://www.wbsec.nl/vembu"
}
]
},
"source": {
"advisory": "DIVD-2020-00011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-26471",
"datePublished": "2021-06-08T18:36:14.329Z",
"dateReserved": "2021-02-01T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:22:33.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}