CVE-2021-27183 json
An issue was discovered in MDaemon before 20.0.4.
published 2021-04-14 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-13950
- cvss
- 7.2
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 86%
- public exploits
- 0
- none known
Summary
An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution.
Patch / fix
- altn mdaemon 20.0.4
Exploit prediction
2.70% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/chudyPB/MDaemon-Advisories referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-610 Externally Controlled Reference to a Resource in Another Sphere
References
-
github.com
/chudyPB/MDaemon-Advisories
exploit, third-party-advisory
-
altn.com
/Support/SecurityUpdate/MD011221_MDaemon_EN/
release-notes, vendor-advisory
Sources
- CVE List CVE-2021-27183
- NVD CVE-2021-27183
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.