CVE-2021-42839 Grand Vice info Co. webopac7 - Arbitrary File Upload

High 8.8 Published 15 Nov 2021 Updated 17 Sep 2024

Remote attackers with general user permissions can upload malicious scripts to execute arbitrary code or disrupt services in webopac7.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-42839?

CVE-2021-42839 is a high-severity vulnerability in Grand Vice info Co. webopac7, published on 15 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upload malicious script and execute arbitrary code to control the system or interrupt services.

Weakness: CWE-434

Which versions are affected by CVE-2021-42839?

It affects 1 product.

Products include Vice Webopac.

How do I fix CVE-2021-42839?

No fix has been published for CVE-2021-42839 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-42839 being exploited?

There is no known exploitation of CVE-2021-42839 in the wild and no public exploit code.

Sources

Also known as GHSA-mhvw-gjfc-ccqf.