CVE-2021-42644 - CVE House

Status published Medium CVE-2021-42644

cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability....

6.5 CVSS

Vulnerability Description

cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-42644

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://jdr2021.github.io/2021/10/14/CmsEasy_7.7.5_20211012%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%86%99%E5%85%A5%E5%92%8C%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/

More from cmseasy

View All →

CVE-2021-42643

cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability....

High 8.8

CVE-2020-18406

An issue was discovered in cmseasy v7.0.0 that allows user...

High 7.5

CVE-2019-8434

In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay...

Medium 6.1

CVE-2019-8432

In CmsEasy 7.0, there is XSS via the ckplayer.php url...

Medium 6.1

CVE-2018-11680

An issue was discovered in CmsEasy 6.1_20180508. There is a...

Medium 6.5

Affected Vendor

cmseasy

View all reports →

Affected Software

cmseasy

Vulnerable Versions:

7.7.5_20211012

Timeline

Official Publish: May 17th, 2022

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.