← back
CVE-2021-36711

CVE-2021-36711

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 16%
from disclosure to weapon5 days
Published on NVDJul 16
1st PoC+5d
exploitation probability
16%top 3% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.
Affected products
n/a · n/a
public PoCs found — 3
exploitdbwww.exploit-db.com/exploits/50979unverifiedcve_referencepacketstormsecurity.com/files/167780/OctoBot-WebInterface-0.4.3-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/167721/Sashimi-Evil-OctoBot-Tentacle.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/167780/OctoBot-WebInterface-0.4.3-Remote-Code-Execution.htmlhttps://github.com/Drakkar-Software/OctoBot/blob/master/CHANGELOG.mdhttps://github.com/Drakkar-Software/OctoBot/issues/1966https://github.com/Nwqda/Sashimi-Evil-OctoBot-Tentaclehttps://packetstormsecurity.com/files/167721/Sashimi-Evil-OctoBot-Tentacle.htmlhttps://www.octobot.online/