CVE-2021-39274 Misconfiguration in n/a
Insecure directory permissions in Sn1per allow unprivileged users to modify application files, leading to arbitrary code execution with root privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-39274?
CVE-2021-39274 is a critical vulnerability in n/a, published on 19 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user to modify the main application and the application configuration file. This results in arbitrary code execution with root privileges.
Weakness: CWE-276
Which versions are affected by CVE-2021-39274?
It affects 1 product.
Products include Xerosecurity Sn1per.
How do I fix CVE-2021-39274?
No fix has been published for CVE-2021-39274 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-39274 being exploited?
There is no known exploitation of CVE-2021-39274 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-77g9-3552-f5x8.