Riskcovery

CVE-2021-26639

WISA Smart Wing CMS File Download Vulnerability

State
Published
Severity
8.1 High
Published
Aug 17, 2022
Updated
Aug 3, 2024
Reserved
Feb 3, 2021

Read the record on cve.org

Description

This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nkrcert

Weaknesses

  • CWE-494 Download of Code Without Integrity Check
  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
Smart Wing CMSWISA corp.
  • before r18715.20211229Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.