CVE-2021-25971

MEDIUM
Published Oct 20, 20214y ago · Modified Jun 17, 20261w ago
4.3 CVSS 3.1
Medium
Find Similar
Published Oct 20, 2021 4y ago
Last Modified Jun 17, 2026 1w ago

Description

In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file

CVSS Details

Base Score
4.3
Exploitability
2.8
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability Low

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-248
CWE-755

Affected Products 1

VendorProductVersionRange
tuzitiocamaleon_cms*≥2.0.1  –  ≤2.6.0

References 2

  • github.com https://github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2
    PatchThird Party Advisory
  • whitesourcesoftware.com https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25971
    Third Party Advisory

Remediation

  • github.com https://github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2
    PatchThird Party Advisory