Vulnerabilities > CVE-2021-36233 - Files or Directories Accessible to External Parties vulnerability in Unit4 Mik.Starlight 7.9.5.24363

047910
CVSS 4.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
unit4
CWE-552

Summary

The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the filesystem by specifying the file path.

Vulnerable Configurations

Part Description Count
Application
Unit4
1