quorum vulnerabilities and fixes

Recent CVEs affecting quorum, with upgrade or downgrade steps. 9 tracked.

quorum has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 9. Most recent: 2021-07-25. Highest priority: CVE-2021-37447 (score 52/100).

CVE-2021-37467 MEDIUM 5.4 UPGRADE In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
CVE-2021-37466 MEDIUM 5.4 UPGRADE In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
CVE-2021-37465 MEDIUM 5.4 UPGRADE In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
CVE-2021-37464 MEDIUM 5.4 UPGRADE In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
CVE-2021-37463 MEDIUM 5.4 UPGRADE In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
CVE-2021-37452 MEDIUM 5.5 UPGRADE NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by r
CVE-2021-37447 HIGH 8.1 UPGRADE In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.
CVE-2021-37446 MEDIUM 4.3 UPGRADE In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.
CVE-2021-37445 MEDIUM 6.5 UPGRADE In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.

FAQ

How do I fix quorum vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is quorum being exploited right now?

None of the tracked quorum CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which quorum CVE should I patch first?

CVE-2021-37447 currently ranks highest (52/100): In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/..

RSS feed for quorum · ← Back to latest CVEs