PT-2021-17022
CVE-2021-26476
·
Published
2021-03-01
·
Updated
2021-03-04
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
EPrints version 3.4.2
Description
The issue allows remote attackers to execute OS commands via crafted LaTeX input to a "cgi/cal?year=" URI.
Recommendations
For EPrints version 3.4.2, consider restricting access to the cgi/cal endpoint until a patch is available. As a temporary workaround, avoid using crafted LaTeX input in the affected URI to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾