ByteOS Network

NVD Vulnerability Details :

CVE-2021-40875

Analyzed

Source-cve@mitre.org

Published At-22 Sep, 2021 | 15:15

Updated At-12 Jul, 2022 | 17:42

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The corresponding file paths can be tested, and in some cases, result in the disclosure of hardcoded credentials, API keys, or other sensitive data.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

gurock>>testrail>>Versions before 7.2.0.3014(exclusive)

cpe:2.3:a:gurock:testrail:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-425	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/164270/Gurock-Testrail-7.2.0.3014-Improper-Access-Control.html	cve@mitre.org	Exploit Third Party Advisory VDB Entry
https://github.com/SakuraSamuraii/derailed	cve@mitre.org	Third Party Advisory
https://johnjhacking.com/blog/cve-2021-40875/	cve@mitre.org	Exploit Third Party Advisory
https://www.gurock.com/testrail/tour/enterprise-edition	cve@mitre.org	Product Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History