CVE-2021-46354

Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

12.89% chance of exploitation in the next 30 days, 96th percentile

Published

2022-02-09

Updated

2026-07-09

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50771

References

• CVE Record
• NVD entry

Related

• CVE-2021-46351
• CVE-2021-46360
• CVE-2021-46350
• CVE-2021-46361
• CVE-2021-46349
• CVE-2021-46362