File Upload Vulnerability in InvoicePlane by NotNNor
CVE-2021-29022

5.3MEDIUM

Key Information:

Vendor

Invoiceplane

Status
Invoiceplane
Vendor
CVE Published:
10 May 2021

What is CVE-2021-29022?

In InvoicePlane version 1.5.11, a security issue was identified where the file upload feature inadvertently reveals the complete path of the file upload directory. This vulnerability poses a risk as it can potentially expose sensitive information about the server's file system structure, making it easier for attackers to exploit the application further. Organizations using this version are advised to apply necessary security measures to mitigate the risk.

References

https://notnnor.github.io/research/2021/03/17/full-path-d...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.