CVE-2021-44164 CRITICAL

CVE-2021-44164: Chain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File Upload

Weakness CWE-434 · Unrestricted file upload
Published December 20, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or terminate service.

Key dates

02Disclosure timeline

December 20, 2021 CVE published
September 16, 2024 Record updated