CVE-2021-3378

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting Assets/temp/hotspot/img/logohotspot.asp.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Feb 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-337808.8Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-337818.1Azure AD Security Feature Bypass VulnerabilityCVE-2021-337825.5Windows Authenticode Spoofing VulnerabilityCVE-2021-337836.5Windows SMB Information Disclosure VulnerabilityCVE-2021-337847.8Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityCVE-2021-337857.5Windows AF_UNIX Socket Provider Denial of Service VulnerabilityCVE-2021-337868.1Windows LSA Security Feature Bypass VulnerabilityCVE-2021-337887.5Windows LSA Denial of Service VulnerabilityCVE-2021-337909.8The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as pCVE-2021-337927.8Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary.CVE-2021-337939.8Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during OCVE-2021-337949.1Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 allow information disclosure or an application crash after mishandling the Tab key d
CVE-2021-3378: Critical severity, CVSS 9.8 | Vulnix