ivm attendant vulnerabilities and fixes

Recent CVEs affecting ivm attendant, with upgrade or downgrade steps. 7 tracked.

Also searched as: ivmattendant.

ivm attendant has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2021-07-25. Highest priority: CVE-2021-37444 (score 51/100).

• CVE-2021-37451 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
• CVE-2021-37450 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
• CVE-2021-37449 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
• CVE-2021-37448 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
• CVE-2021-37444 HIGH 8.8 UPGRADE NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZI
• CVE-2021-37443 HIGH 8.1 UPGRADE NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file
• CVE-2021-37442 MEDIUM 6.5 UPGRADE NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.

FAQ

How do I fix ivm attendant vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is ivm attendant being exploited right now?

None of the tracked ivm attendant CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which ivm attendant CVE should I patch first?

CVE-2021-37444 currently ranks highest (51/100): NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZI.

RSS feed for ivm attendant · ← Back to latest CVEs