CVE-2021-40875

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The corresponding file paths can be tested, and in some cases, result in the disclosure of hardcoded credentials, API keys, or other sensitive data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-425

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-40887.2SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 all CVE-2021-408819.8An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.CVE-2021-408826.1A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.CVE-2021-408839.8A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.CVE-2021-408848.1Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-e CVE-2021-408866.5Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` param CVE-2021-408879.8Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, a CVE-2021-408885.4Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() fu CVE-2021-408899.8CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_put CVE-2021-40894.3snipe-it is vulnerable to Improper Access Control CVE-2021-408927.5A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) st CVE-2021-408937.5A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.