CVE-2021-36359

OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reached via bscw.cgi op=_editfolder.EditFolder) calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

3.98% chance of exploitation in the next 30 days, 90th percentile

Published

2021-08-30

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/163988/BSCW-Server-XML-Injection.html
• http://seclists.org/fulldisclosure/2021/Aug/23

References

• CVE Record
• NVD entry

Related

• CVE-2021-36356
• CVE-2021-36380
• CVE-2021-36352
• CVE-2021-36383
• CVE-2021-36351
• CVE-2021-36393