What is CVE-2021-40095?

CVE-2021-40095 is a medium-severity vulnerability in Squaredup. CVSS score: 4.9/10. Published 2021-12-07.

How severe is CVE-2021-40095?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Is CVE-2021-40095 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Squaredup

CVE-2021-40095

An issue was discovered in SquaredUp for SCOM 5.2.1.6654. The Download Log feature in System / Maintenance was susceptible to a local file inclusion vulnerability (when processing remote input in the log files downloaded by an authenticated administrator user), leading to the ability to read arbitrary files on the server filesystems.

EPSS: 0.010 (58.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Squaredup
N/a — versions n/a

Public proof-of-concept exploits

kaje11/CVEs

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-40095?: CVE-2021-40095 is a medium-severity vulnerability in Squaredup. CVSS score: 4.9/10. Published 2021-12-07.
How severe is CVE-2021-40095?: Medium severity. CVSS v3 base score is 4.9 out of 10.
Is CVE-2021-40095 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.