CVE-2021-43829

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature. This vulnerability is capable of uploading dangerous type of file to server leading to XSS attacks and potentially other forms of code injection. Users are advised to update to 1.7.7 as soon as possible. There are no known workarounds for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Patrowl	PatrowlManager	< 1.7.7

References

https://github.com/Patrowl/PatrowlManager/commit/2287c9715d2e7ef11b44bb0ad4a57727654f2203Patch, Third Party Advisory
https://github.com/Patrowl/PatrowlManager/security/advisories/GHSA-5hc9-6hq4-2xfxThird Party Advisory
https://huntr.dev/bounties/17324785-f83a-4058-ac40-03f2bfa16399/Exploit, Patch, Third Party Advisory
https://github.com/Patrowl/PatrowlManager/commit/2287c9715d2e7ef11b44bb0ad4a57727654f2203Patch, Third Party Advisory
https://github.com/Patrowl/PatrowlManager/security/advisories/GHSA-5hc9-6hq4-2xfxThird Party Advisory
https://huntr.dev/bounties/17324785-f83a-4058-ac40-03f2bfa16399/Exploit, Patch, Third Party Advisory

Timeline

Published: Dec 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-43834.3The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due CVE-2021-438308.8OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets modu CVE-2021-438317.7Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnera CVE-2021-438329.8Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execu CVE-2021-438338.8eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows any authe CVE-2021-438349.8eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows an attack CVE-2021-438357.2Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any CVE-2021-438368.8Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary loc CVE-2021-438379.1vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vaul CVE-2021-438387.5jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a CVE-2021-438397.5Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fe CVE-2021-43844.3The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin