CVE-2021-41714
MEDIUM
6.5
CVSS Score
Published: May 23, 2022 at 03:34 PM UTC
Updated: June 17, 2026 at 04:08 AM UTC
1 product affected across 1 vendorTipask
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.5
Exploit prediction
EPSS 0.7%
Description
In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (3)
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://github.com/sdfsky/tipask/blob/c4e6aa9f6017c9664780570016954c0922d203b7/app/Http/Controllers/AttachController.php#L42x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/sdfsky/tipask/commit/9b5f13d1708e9a5dc0959cb8a97be1c32b94ca69x_refsource_MISCThird Party Advisory
Source: [email protected]
https://www.yuque.com/henry-weply/penetration/fza5hmCVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- NONE
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-494
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card