Vulnerability Description
Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells files belonging to any user, via the format parameter.
CVSS Score
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pydio | Cells | 2.2.9 |
Related Weaknesses (CWE)
References
- https://charonv.net/Pydio-Broken-Access-Control/Third Party Advisory
- https://github.com/pydio/cells/releases/tag/v2.2.12Release NotesThird Party Advisory
- https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212ProductVendor Advisory
- https://charonv.net/Pydio-Broken-Access-Control/Third Party Advisory
- https://github.com/pydio/cells/releases/tag/v2.2.12Release NotesThird Party Advisory
- https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212ProductVendor Advisory
FAQ
What is CVE-2021-41323?
CVE-2021-41323 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells files belonging to any user, via the format parameter.
How severe is CVE-2021-41323?
CVE-2021-41323 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-41323?
Check the references section above for vendor advisories and patch information. Affected products include: Pydio Cells.