NetSight
IP …
high8.8

CVE-2021-39271

OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class at…

Impact

OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class attribute of a .bscw file. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.

Affected products

VendorProductAffected versions
BscwBscw Classic
before 5.0.12
from 5.1.0 before 5.1.10
from 5.2.0 before 5.2.4
from 7.3.0 before 7.3.3
from 7.4.0 before 7.4.3

References