CVE-2021-20104 File upload in AppNitro Machform
Unauthenticated attackers can achieve remote code execution by uploading malicious files via the form attachment feature in Machform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20104?
CVE-2021-20104 is a high-severity vulnerability in AppNitro Machform, published on 29 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms through upload.php.
Weakness: CWE-434
Which versions are affected by CVE-2021-20104?
It affects 1 product.
Products include Machform Machform.
How do I fix CVE-2021-20104?
No fix has been published for CVE-2021-20104 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20104 being exploited?
There is no known exploitation of CVE-2021-20104 in the wild and no public exploit code.
Other vulnerabilities in AppNitro Machform
Sources
Also known as GHSA-2gq4-6723-j8cq.