CVE-2021-46417

Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

7.8 HIGHAV:N/AC:L/Au:N/C:C/I:N/A:N

EPSS

59.75% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-22

Published

2022-04-07

Updated

2024-08-04

Proof-of-concept exploits (4)

• http://packetstormsecurity.com/files/166610/FFS-Colibri-Controller-Module-1.8.19.8580-Dir…
• http://packetstormsecurity.com/files/166671/Franklin-Fueling-Systems-Colibri-Controller-M…
• https://drive.google.com/drive/folders/1Yu4aVDdrgvs-F9jP3R8Cw7qo_TC7VB-R
• Henry4E36/CVE-2021-464170★ · 2022-05-18

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46417.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50861

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2021/CVE-2021-46417.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2018-20463
• CVE-2021-41277
• CVE-2022-1388
• CVE-2022-30525
• CVE-2022-31269
• CVE-2022-33174