CVE-2021-47760
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| testlink | testlink | From 1.16 (inc) to 1.19 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects TestLink versions 1.16 through 1.19 and involves an unauthenticated file download issue in the attachmentdownload.php script. Attackers can exploit this by sending requests with the 'id' parameter (representing file IDs) and 'skipCheck=1' to bypass session validation and access controls, allowing them to download arbitrary files without authentication. [1, 3]
How can this vulnerability impact me? :
The vulnerability allows attackers to download arbitrary files from the TestLink server without authentication. This can lead to unauthorized access to potentially sensitive or confidential attachments, exposing private information and compromising data security. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the attachmentdownload.php endpoint with the 'id' parameter and 'skipCheck=1' without authentication. For example, you can use curl commands to test if arbitrary files can be downloaded by iterating file IDs. A sample command is: curl -i "http://HOST/lib/attachments/attachmentdownload.php?id=1&skipCheck=1". By incrementing the 'id' parameter, you can check if files are accessible without authentication, indicating the vulnerability. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the attachmentdownload.php endpoint to authenticated users only, disabling or removing the 'skipCheck=1' parameter functionality, and applying any available patches or updates from the vendor. Additionally, consider implementing web application firewall (WAF) rules to block unauthorized requests to this endpoint and monitor access logs for suspicious activity. [1, 3]