CVE-2021-40870 — Aviatrix Controller Unrestricted Upload of File

provenance: imported · CVE: CVE-2021-40870

CVE-2021-40870: Aviatrix Controller Unrestricted Upload of File

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Aviatrix
Product	Aviatrix Controller
Date added	2022-01-18
Due date	2022-02-01
Ransomware campaign use	Unknown

Description

Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-40870

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-40870
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog