CVE-2021-44164

Chain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File Upload

State: Published
Severity: 9.8 Critical
Published: Dec 20, 2021
Updated: Sep 16, 2024
Reserved: Nov 23, 2021

Description

Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or terminate service.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
ai chatbot systemChain Sea Information Integration Co., Ltd	0Unknown

References

https://www.twcert.org.tw/tw/cp-132-5400-c31d1-1.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.