CVE-2021-23562
Arbitrary File Upload
HIGH
8.8
CVSS Score
Published: December 3, 2021 at 08:00 PM UTC
Updated: June 17, 2026 at 03:38 AM UTC
1 product affected across 1 vendorPlupload
Using plupload by N/A?
Get instant alerts when new vulnerabilities affect plupload - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.8
Exploit prediction
EPSS 1%
Description
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://github.com/moxiecode/plupload/commit/d12175d4b5fa799b994ee1bb17bfbeec55b386fb
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2306665
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2306663
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMOXIECODE-2306664
- https://snyk.io/vuln/SNYK-JS-PLUPLOAD-1583909
References (6)
x_refsource_MISCBroken Link
Source: [email protected]
https://github.com/moxiecode/plupload/blob/master/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/moxiecode/plupload/commit/d12175d4b5fa799b994ee1bb17bfbeec55b386fbx_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2306665x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2306663x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMOXIECODE-2306664x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://snyk.io/vuln/SNYK-JS-PLUPLOAD-1583909CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-434
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card