CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43833 – Account takeover in eLabFTW
https://notcve.org/view.php?id=CVE-2021-43833
eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows any authenticated user to gain access to arbitrary accounts by setting a specially crafted email address. This vulnerability impacts all instances that have not set an explicit email domain name allowlist. Note that whereas neither administrators nor targeted users are notified of a change, an attacker will need to control an account. The default settings require administrators to validate newly created accounts. • https://github.com/elabftw/elabftw/releases/tag/4.2.0 https://github.com/elabftw/elabftw/security/advisories/GHSA-v659-q2fh-v99w • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 1CVE-2021-41171 – Bypass bruteforce protection on login form in elabftw
https://notcve.org/view.php?id=CVE-2021-41171
eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing brute force login protection, as recommended by Owasp with Device Cookies. This mechanism will not impact users and will effectively thwart any brute-force attempts at guessing passwords. The only correct way to address this is to upgrade to version 4.1.0. • https://github.com/elabftw/elabftw/commit/8e92afeec4c3a68dc88333881b7e6307f425706b https://github.com/elabftw/elabftw/releases/tag/4.1.0 https://github.com/elabftw/elabftw/security/advisories/GHSA-q67h-5pc3-g6jv https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies https://www.exploit-db.com/docs/50436 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32698 – Blind Server-Side Request Forgery (SSRF) in eLabFTW
https://notcve.org/view.php?id=CVE-2021-32698
eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0. eLabFTW es un cuaderno de laboratorio electrónico de código abierto para laboratorios de investigación. Esta vulnerabilidad permite a un atacante realizar peticiones GET en nombre del servidor. • https://github.com/elabftw/elabftw/commit/3d2db4d3ad90b0915f29f05aeba41eaaf6a7c726 https://github.com/elabftw/elabftw/security/advisories/GHSA-mh6g-62p8-26m4 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.0EPSS: 6%CPEs: 1EXPL: 3CVE-2019-12185 – eLabFTW 1.8.5 - Arbitrary File Upload / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-12185
eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. eLabFTW 1.8.5 es vulnerable a cargas de archivos arbitrarios a través del componente /app/controllers/EntityController.php. Esto puede resultar en la ejecución remota de comandos. • https://www.exploit-db.com/exploits/46869 http://incidentsecurity.com/elabftw-1-8-5-entitycontroller-arbitrary-file-upload-rce https://github.com/fuzzlove/eLabFTW-1.8.5-EntityController-Arbitrary-File-Upload-RCE • CWE-434: Unrestricted Upload of File with Dangerous Type •