Skip to content
Fencer Vulns
high 7.4

CVE-2021-43829 in the critical feed json

Unrestricted Upload of Files in Patrowl

published 2021-12-14 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-30709

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
59.2%
EPSS 59.2% chance of exploitation in 30 days, percentile 99.1%
public exploits
0
none known

Summary

PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature. This vulnerability is capable of uploading dangerous type of file to server leading to XSS attacks and potentially other forms of code injection. Users are advised to update to 1.7.7 as soon as possible. There are no known workarounds for this issue.

Patch / fix

  • patrowl patrowlmanager 1.7.7

Exploit prediction

59.25% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.dev https://huntr.dev/bounties/17324785-f83a-4058-ac40-03f2bfa16399/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • Patrowl PatrowlManager

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.