CVE-2021-32093

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealedExploit, Third Party Advisory
https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeoverExploit, Third Party Advisory
https://blog.sonarsource.com/code-vulnerabilities-in-nsa-application-revealedExploit, Third Party Advisory
https://portswigger.net/daily-swig/nsa-workflow-application-emissary-vulnerable-to-malicious-takeoverExploit, Third Party Advisory

Timeline

Published: May 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-320948.8U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.CVE-2021-320958.1U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.CVE-2021-320968.8The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary R CVE-2021-320989.8Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.CVE-2021-320999.8A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his u CVE-2021-32109.6components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands wh CVE-2021-321006.5A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user.CVE-2021-321018.2The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the CVE-2021-321028.8A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.CVE-2021-321034.8A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject CVE-2021-321048.8A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.CVE-2021-321065.4In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the