CVE-2021-35380

high-risk
Published 2022-02-15

A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download (http://url:port/file?valore).

Do I need to act?

!
73.5% chance of exploitation in next 30 days
EPSS score — higher than 27% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
50638
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Solari

References (6)

Exploit https://www.exploit-db.com/exploits/50638
Third Party Advisory https://www.swascan.com/it/security-blog/
Third Party Advisory https://www.swascan.com/solari-di-udine/
Exploit https://www.exploit-db.com/exploits/50638
Third Party Advisory https://www.swascan.com/it/security-blog/
Third Party Advisory https://www.swascan.com/solari-di-udine/
50
/ 100
high-risk
Severity 26/34 · High
Exploitability 19/34 · Moderate
Exposure 5/34 · Minimal