CVE-2021-34805

An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau file on the operating system without preventing %2e%2e%5c directory traversal.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

7.8 HIGHAV:N/AC:L/Au:N/C:C/I:N/A:N

EPSS

26.82% chance of exploitation in the next 30 days, 98th percentile

Nuclei

high · CWE-22

Published

2022-01-31

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/165701/FAUST-iServer-9.0.018.018.4-Local-File-Inclus…
• https://sec-consult.com/vulnerability-lab/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34805.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-34767
• CVE-2021-34824
• CVE-2021-34730
• CVE-2021-3485
• CVE-2021-34693
• CVE-2021-3490