CVE-2021-42342
CRITICAL 9.8EPSS 59.5%
An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 59.46% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2021-10-14
- Updated
- 2024-08-04
Proof-of-concept exploits (2)
- Mr-xn/CVE-2021-4234241★ · 2022-01-04
- kimusan/goahead-webserver-pre-5.1.5-RCE-PoC-CVE-2021-42342-23★ · 2021-10-18