CVE-2021-40841

Medium

Published: 18 February 2022

Published

18 February 2022

Modified

21 November 2024

KEV Added

—

Patch

—

CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0038 60.0th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-40841 is a medium-severity Path Traversal (CWE-22) vulnerability in Liveconfig Liveconfig. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 40.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

A Path Traversal vulnerability for a log file in LiveConfig 2.12.2 allows authenticated attackers to read files on the underlying server.

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

liveconfig

≤ 2.12.2

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

https://www.liveconfig.com/en/changelog/
Release Notes, Third Party Advisory · cve@mitre.org
https://www.mgm-sp.com/en/liveconfig-2-12-2-vulnerabilities/
Third Party Advisory · cve@mitre.org
https://www.liveconfig.com/en/changelog/
Release Notes, Third Party Advisory · af854a3a-2127-422b-91ae-364da2661108
https://www.mgm-sp.com/en/liveconfig-2-12-2-vulnerabilities/
Third Party Advisory · af854a3a-2127-422b-91ae-364da2661108