CVE-2021-35380 EXPLOIT
7.5
HIGH · CVSS 3.1 · EPSS 39% (pctl 99)
Patch early
A public exploit exists.
Description
A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download (http://url:port/file?valore).
Scoring
| CVSS | 7.5 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 38.95% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-22 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2022-02-15 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| solari | termtalk server |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | TermTalk Server 3.24.0.2 - Arbitrary File Read (Unauthenticated) | 2022-01-05 |
References
→ the Explorer · watch your stack · NVD