CVE-2021-46354

Name of the Vulnerable Software and Affected Versions Thinfinity VirtualUI versions 2.1.28.0 through 2.5.26.2

Description The issue affects the Addr parameter in the cmd site, allowing the vulnerable server to disclose information or increase the attack surface by sending requests to other systems. This can potentially allow the filtration of the real IP of the web server.

Recommendations For Thinfinity VirtualUI versions 2.1.28.0 through 2.5.26.2, update to version 3.0 to resolve the issue. As a temporary workaround, consider restricting access to the Addr parameter in the cmd site until a patch is available.