CVE-2021-28428

Published Apr 5, 2022

Last updated 3 years ago

CVSS critical 9.8

Overview

Description: File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *.hello files using the Media Files upload functionality. The original file upload vulnerability (CVE-2020-27387) was remediated by restricting the PHP extensions; however, we confirmed that the filter was bypassed via uploading an arbitrary .htaccess and *.hello files in order to execute PHP code to gain RCE.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0837AB3F-932A-464D-B078-041C1D167681"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "819778BF-D6F0-41DE-ADF2-3BB80E05DD93"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BDF18A37-08AC-4501-8C15-151DE7B44DED"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E6F3AB6F-BD6E-4F8C-952F-AB55E11D7D23"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C1817B54-40E9-4150-8A24-2023FD19BB43"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A6585D37-41CF-436A-A4AA-F91AE092D288"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E496572C-0A79-4524-B544-E864FBFEDFD8"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A7117177-3CD2-4BE9-982A-FBFEF60A7C23"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:alpha8:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EB1E6057-C7F5-4D4F-B112-437C801DCCF4"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:beta:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "320BB8EF-D310-4420-9EA9-CA06DFA03DE5"
          },
          {
            "criteria": "cpe:2.3:a:horizontcms_project:horizontcms:1.0.0:beta2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9840814D-4A55-468B-8F55-EEEE82D7EA29"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References