CVE-2021-40870: Aviatrix Controller Unrestricted Upload of File
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Aviatrix Controllerto a version that resolves this vulnerability.Fixed in 6.5-1804.1922
Event History
Frequently Asked Questions
What is CVE-2021-40870?
CVE-2021-40870 is a vulnerability in Aviatrix Controller that allows an unauthenticated user to execute arbitrary code via directory traversal.
How severe is CVE-2021-40870?
CVE-2021-40870 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2021-40870?
Aviatrix Controller versions 6.2 before 6.2.2043, 6.3 before 6.3.2490, 6.4 before 6.4.2838, and 6.5 before 6.5.1922 are affected by CVE-2021-40870.
How can an unauthenticated user exploit CVE-2021-40870?
An unauthenticated user can exploit CVE-2021-40870 by uploading a file with a dangerous type through a directory traversal attack.
Are there any references for CVE-2021-40870?
Yes, you can find references for CVE-2021-40870 at the following links: [Link 1](http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html), [Link 2](https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021), [Link 3](https://wearetradecraft.com/advisories/tc-2021-0002/).