CVE-2021-39274

2021-08-1912:15:09

Google

osv.dev

7.5 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.3%

JSON

In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user to modify the main application and the application configuration file. This results in arbitrary code execution with root privileges.

CPENameOperatorVersion
sn1pereq5.2
sn1pereq4.3
sn1pereq5.6
sn1pereq2.6
sn1pereq7.2
sn1pereq8.0
sn1pereq2.5
sn1pereq5.8
sn1pereq2.7
sn1pereq7.4

Name	Operator	Version
sn1per	eq	5.2
sn1per	eq	4.3
sn1per	eq	5.6
sn1per	eq	2.6
sn1per	eq	7.2
sn1per	eq	8.0
sn1per	eq	2.5
sn1per	eq	5.8
sn1per	eq	2.7
sn1per	eq	7.4

Rows per page:

1-10 of 501

References

github.com/1N3/Sn1per/issues/357

github.com/1N3/Sn1per/releases

github.com/nikip72/CVE-2021-39273-CVE-2021-39274