High severity · published Apr 14, 2021
CVE-2021-27183
An issue was discovered in MDaemon before 20.0.4
7.2
CVSS
2.7%
EPSS
No
On KEV
Description
An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Mdaemon · Altn
before 20.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27183
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27183
Exploit
https://github.com/chudyPB/MDaemon-Advisories
Release Notes
https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/
More from Mdaemon
8.8
CVE-2021-27182
An issue was discovered in MDaemon before 20.0.4
8.8
CVE-2021-27181
An issue was discovered in MDaemon before 20.0.4
6.1
CVE-2021-27180
An issue was discovered in MDaemon before 20.0.4
6.1
CVE-2019-8983
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2)
6.1
CVE-2019-8984
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2)