CVE Feed

    Dashboard / CVE / CVE-2021-33558

    CVE-2021-33558

    Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not part of Boa.

    Published:May 27, 2021
    Last Modified:Nov 21, 2024
    EPS:May 27, 2021
    EPSS Score:0.90363
    CVSS Score:7.5

    Affected Products

    Vendor
    Boa
    Product
    Boa

    Exploits

    https://github.com/mdanzaruddin/CVE-2021-33558.https://github.com/mdanzaruddin/CVE-2021-33558.https://github.com/anldori/CVE-2021-33558https://github.com/mdanzaruddin/CVE-2021-33558.

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-56498 (CVSS 5.3) — An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web managem…
    CVE-2024-43367 (CVSS 7.5) — Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to…
    CVE-2022-45956 (CVSS 5.3) — Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD H…
    CVE-2022-44117 (CVSS 9.8) — Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties b…
    CVE-2018-21028 (CVSS 7.5) — Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free …
    CVE-2018-21027 (CVSS 9.8) — Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is …
    CVE-2017-9833 (CVSS 7.5) — /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET…
    CVE-2016-9564 (CVSS 7.5) — Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET reque…
    CVE-2009-4496 (CVSS 5) — Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remot…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High