CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-29281
Critical (9.8) in gfi archiver. EPSS 2.6% chance of exploitation in the next 30 days.
File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317.
Severity
- EPSS
- 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-434
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gfi:archiver
References
- https://aminbohio.com/gfi-mail-archiver-15-1-telerik-ui-component-arbitrary-file-upload-unauthenticated-exploit/
- https://cwe.mitre.org/data/definitions/434.html
- https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
- https://www.exploit-db.com/exploits/50181
- https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiver