CVE-2021-36359
Last modified
CVE-2021-36359 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reached via bscw.cgi op=_editfolder.EditFolder) calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.. EPSS estimates a 3.98% chance of exploitation in the next 30 days.
Description
OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reached via bscw.cgi op=_editfolder.EditFolder) calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bscw | Bscw Classic | < 5.0.12 |
| Bscw | Bscw Classic | >= 5.1.0, < 5.1.10 |
| Bscw | Bscw Classic | >= 5.2.0, < 5.2.4 |
| Bscw | Bscw Classic | >= 7.3.0, < 7.3.3 |
| Bscw | Bscw Classic | >= 7.4.0, < 7.4.3 |
References
- http://packetstormsecurity.com/files/163988/BSCW-Server-XML-Injection.htmlExploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/Aug/23Exploit, Mailing List, Third Party Advisory
- https://www.bscw.de/en/company/Vendor Advisory
- http://packetstormsecurity.com/files/163988/BSCW-Server-XML-Injection.htmlExploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/Aug/23Exploit, Mailing List, Third Party Advisory
- https://www.bscw.de/en/company/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-36359?
How severe is CVE-2021-36359?
How do I fix CVE-2021-36359?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-3635A flaw was found in the Linux kernel netfilter implementatio…4.4
- CVE-2021-36350Dell PowerScale OneFS, versions 8.2.2-9.3.0.x, contain an au…7.5
- CVE-2021-36351SQL Injection Vulnerability in Care2x Open Source Hospital I…9.8
- CVE-2021-36352Stored cross-site scripting (XSS) vulnerability in Care2x Ho…5.4
- CVE-2021-36356KRAMER VIAware through August 2021 allows remote attackers t…9.8
- CVE-2021-36357An issue was discovered in OpenPOWER 2.6 firmware. unpack_ti…9.8
- CVE-2021-3636It was found in OpenShift, before version 4.8, that the gene…4.6
- CVE-2021-36363Nagios XI before 5.8.5 has Incorrect Permission Assignment f…9.8
- CVE-2021-36364Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildc…9.8
- CVE-2021-36365Nagios XI before 5.8.5 has Incorrect Permission Assignment f…9.8
- CVE-2021-36366Nagios XI before 5.8.5 incorrectly allows manage_services.sh…9.8
- CVE-2021-36367PuTTY through 0.75 proceeds with establishing an SSH session…8.1
Are you affected by CVE-2021-36359?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST