CVE-2021-26804
Last modified
CVE-2021-26804 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading it in the "Administration/ Parameters/ Images" section of the application.. EPSS estimates a 1.19% chance of exploitation in the next 30 days.
Description
Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading it in the "Administration/ Parameters/ Images" section of the application.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Centreon | Centreon Web | 19.10.18 |
| Centreon | Centreon Web | 20.04.8 |
| Centreon | Centreon Web | 20.10.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-26804?
How severe is CVE-2021-26804?
How do I fix CVE-2021-26804?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-26788Oryx Embedded CycloneTCP 1.7.6 to 2.0.0, fixed in 2.0.2, is …7.5
- CVE-2021-26794Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9…9.8
- CVE-2021-26795A SQL Injection vulnerability in /appliance/shiftmgn.php in …8.8
- CVE-2021-26797An access control vulnerability in Hame SD1 Wi-Fi firmware <…9.8
- CVE-2021-26799Cross Site Scripting (XSS) vulnerability in admin/files/edit…6.1
- CVE-2021-26800Cross Site Request Forgery (CSRF) vulnerability in Change-pa…6.5
- CVE-2021-26805Buffer Overflow in tsMuxer 2.6.16 allows attackers to cause …5.5
- CVE-2021-26807GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zl…7.8
- CVE-2021-26809PHPGurukul Car Rental Project version 2.0 suffers from a rem…9.8
- CVE-2021-26810D-link DIR-816 A2 v1.10 is affected by a remote code injecti…9.8
- CVE-2021-26812Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8…6.1
- CVE-2021-26813markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regul…7.5
Are you affected by CVE-2021-26804?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST