CVE-2021-36389

In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".

• CWE-639

• http://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Oct/15Third Party Advisory
• https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities/
• https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.mdThird Party Advisory
• https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6Release Notes, Vendor Advisory
• http://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Oct/15Third Party Advisory
• https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities/
• https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.mdThird Party Advisory
• https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6Release Notes, Vendor Advisory

Published

Oct 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36382Devolutions Server before 2021.1.18, and LTS before 2020.3.2…3.7
• CVE-2021-36383Xen Orchestra (with xo-web through 5.80.0 and xo-server thro…4.3
• CVE-2021-36385A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 al…9.8
• CVE-2021-36386report_vbuild in report.c in Fetchmail before 6.4.20 sometim…7.5
• CVE-2021-36387In Yellowfin before 9.6.1 there is a Stored Cross-Site Scrip…5.4
• CVE-2021-36388In Yellowfin before 9.6.1 it is possible to enumerate and do…7.5
• CVE-2021-3639A flaw was found in mod_auth_mellon where it does not saniti…6.1
• CVE-2021-36392In Moodle, an SQL injection risk was identified in the libra…9.8
• CVE-2021-36393In Moodle, an SQL injection risk was identified in the libra…9.8
• CVE-2021-36394In Moodle, a remote code execution risk was identified in th…9.8
• CVE-2021-36395In Moodle, the file repository's URL parsing required additi…7.5
• CVE-2021-36396In Moodle, insufficient redirect handling made it possible t…7.5