CVE-2021-37770 - CVE House
Back to Database
Status published High CVE-2021-37770

Nucleus CMS v3.71 is affected by a file upload vulnerability....

Vulnerability Description

Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with shell, treat it as PHP, execute commands, so as to take down website resources.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-37770

Credits & Attribution

No credits recorded in the NVD database.

References

More from nucleuscms

View All →
CVE-2020-21474
File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker...
Unknown 0
CVE-2018-16636
Nucleus CMS 3.70 allows HTML Injection via the index.php body...
Medium 6.5
CVE-2015-5454
Cross-site scripting (XSS) vulnerability in Nucleus CMS allows remote attackers...
Medium 4.3
CVE-2011-3760
Nucleus 3.61 allows remote attackers to obtain sensitive information via...
Medium 5

Affected Vendor

Affected Software

nucleus cms
Vulnerable Versions:
3.71

Timeline

Official Publish: June 30th, 2022
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.