CVE-2021-37334
Last modified
CVE-2021-37334 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a temporary directory. EPSS estimates a 2.74% chance of exploitation in the next 30 days.
Description
Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a temporary directory. By default, files are stored within the application directory structure at %BASEDIR%/APP_DATA/TEMP/FileUploads/. Whilst access to this directory is restricted by the root web.config file, it is possible to override this restriction by uploading another specially crafted web.config file to the temporary directory. It is possible to exploit this flaw to upload a malicious script file to execute arbitrary code and system commands on the server.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Umbraco | Forms | >= 4.0.0, < 4.4.9 |
| Umbraco | Forms | >= 6.0.0, < 6.0.10 |
| Umbraco | Forms | >= 7.0.0, < 7.0.7 |
| Umbraco | Forms | >= 7.1.0, < 7.1.4 |
| Umbraco | Forms | >= 7.2.0, < 7.2.1 |
| Umbraco | Forms | >= 7.3.0, < 7.3.2 |
| Umbraco | Forms | >= 7.4.0, < 7.4.3 |
| Umbraco | Forms | >= 7.5.0, < 7.5.4 |
| Umbraco | Forms | >= 8.0.0, < 8.0.2 |
| Umbraco | Forms | >= 8.1.0, < 8.1.6 |
| Umbraco | Forms | >= 8.2.0, < 8.2.3 |
| Umbraco | Forms | >= 8.3.0, < 8.3.4 |
| Umbraco | Forms | >= 8.4.0, < 8.4.4 |
| Umbraco | Forms | >= 8.5.0, < 8.5.7 |
| Umbraco | Forms | >= 8.6.0, < 8.6.2 |
| Umbraco | Forms | >= 8.7.0, < 8.7.6 |
References
- https://umbraco.com/blog/security-advisory-20th-of-july-2021-patch-is-now-available/Patch, Vendor Advisory
- https://umbraco.com/blog/security-advisory-20th-of-july-2021-patch-is-now-available/Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-37334?
How severe is CVE-2021-37334?
How do I fix CVE-2021-37334?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-37322GCC c++filt v2.26 was discovered to contain a use-after-free…7.8
- CVE-2021-37326NetSarang Xshell 7 before Build 0077 includes unintended cod…5.3
- CVE-2021-3733There's a flaw in urllib's AbstractBasicAuthHandler class. A…6.5
- CVE-2021-37330Laravel Booking System Booking Core 2.0 is vulnerable to Cro…5.4
- CVE-2021-37331Laravel Booking System Booking Core 2.0 is vulnerable to Inc…5.3
- CVE-2021-37333Laravel Booking System Booking Core 2.0 is vulnerable to Ses…9.8
- CVE-2021-3734yourls is vulnerable to Improper Restriction of Rendered UI …8.8
- CVE-2021-37343A path traversal vulnerability exists in Nagios XI below ver…8.8
- CVE-2021-37344Nagios XI Switch Wizard before version 2.5.7 is vulnerable t…9.8
- CVE-2021-37345Nagios XI before version 5.8.5 is vulnerable to local privil…7.8
- CVE-2021-37346Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerab…9.8
- CVE-2021-37347Nagios XI before version 5.8.5 is vulnerable to local privil…7.8
Are you affected by CVE-2021-37334?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST