CVE-2021-43930

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Apr 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-439319.8The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakneCVE-2021-439326.1Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dasCVE-2021-439335.9The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receiving server, which coulCVE-2021-439349.8Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user toCVE-2021-439359.8The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the aCVE-2021-439369.8The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed wiCVE-2021-439378.8Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request waCVE-2021-439389.8Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authenticatioCVE-2021-439398.8Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests direCVE-2021-43944.3The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missiCVE-2021-439407.8Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the lCVE-2021-439416.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPag