9

CVE-2021-39273

Exploit
In XeroSecurity Sn1per 9.0 (free version), insecure permissions (0777) are set upon application execution, allowing an unprivileged user to modify the application, modules, and configuration files. This leads to arbitrary code execution with root privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xerosecurity ≫ Sn1per Version9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.67% 0.838
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://github.com/1N3/Sn1per/issues/358
Third Party Advisory
Exploit
https://github.com/1N3/Sn1per/releases
Third Party Advisory
Release Notes
https://github.com/nikip72/CVE-2021-39273-CVE-2021-39274
Third Party Advisory
Exploit