CVE-2021-37446: Path Traversal
Published Jul 25, 2021
·Updated
In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
Affected Software
1 affected component
Nchsoftware Quorum<=2.03
Event History
Jul 25, 2021
CVE Published
via MITRE·08:13 PM
Data Sourced
via MITRE·08:13 PM
Description
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-37446.
2
What is the severity of CVE-2021-37446?
The severity of CVE-2021-37446 is medium with a CVSS score of 4.3.
3
What is the affected software?
The affected software is NCH Quorum v2.03 and earlier.
4
How can an authenticated user exploit this vulnerability?
An authenticated user can exploit this vulnerability by using directory traversal via the 'documentprop' parameter with a file path injection (e.g., documentprop?file=/..) to read arbitrary files.
5
Are there any references for this vulnerability?
Yes, you can find references for this vulnerability at the following links: [Link 1](https://github.com/0xfml/poc/blob/main/NCH/Quorum_2.03_LFI.md), [Link 2](https://www.nch.com.au/conference/index.html).