CVEvulnerability
CVE-2021-39274
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-08-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-276
Description
In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user to modify the main application and the application configuration file. This results in arbitrary code execution with root privileges.
Affected configurations
• xerosecurity sn1per 9.0
Related
Weakness · CWE (1)
- CWE-276 Incorrect Default Permissions weakness
References
- https://github.com/1N3/Sn1per/issues/357 Exploit, Third Party Advisory
- https://github.com/1N3/Sn1per/releases Release Notes, Third Party Advisory
- https://github.com/nikip72/CVE-2021-39273-CVE-2021-39274 Exploit, Third Party Advisory
- https://github.com/1N3/Sn1per/issues/357 Exploit, Third Party Advisory
- https://github.com/1N3/Sn1per/releases Release Notes, Third Party Advisory
- https://github.com/nikip72/CVE-2021-39273-CVE-2021-39274 Exploit, Third Party Advisory