CVE-2021-35505
HighCVSS 7.2Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
A vulnerability in Afian FileRun 2021.03.26 allows remote code execution by administrators via the Check Path value for the magick binary.
Risk Assessment
An attacker with administrative privileges can gain full control over the server, compromising data confidentiality, integrity, and availability.
Recommendation
Immediately update to the latest FileRun version and restrict administrative access to trusted users only.
Other vulnerabilities in Afian FileRun
See all- CVE-2021-35506Medium
An XSS vulnerability in Afian FileRun 2021.03.26 allows an attacker to inject malicious scripts when an administrator uses the HTML Editor to preview or edit a crafted document.
- CVE-2021-35504High
A vulnerability in Afian FileRun 2021.03.26 allows remote code execution by administrators via the Check Path value for the ffmpeg binary.
- CVE-2021-35503Medium
Afian FileRun 2021.03.26 is vulnerable to stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. An attacker can inject malicious JavaScript code.
Original NVD description (English source)
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.