Read the docs
TI-2021-19634 Aliases CVE-2021-43828

Improper Privilege Management in Patrowl

Priority LOW 36CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269 and CWE-639.

Summary

PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.77 an improper privilege management (IDOR) has been found in PatrowlManager. All imports findings file is placed under /media/imports/<owner_id>/<tmp_file> In that, owner_id is predictable and tmp_file is in format of import_<ownder_id>_<time_created>, for example: import_1_1639213059582.json This filename is predictable and allows anyone without logging in to download all finding import files This vulnerability is capable of allowing unlogged in users to download all finding imports file. Users are advised to update to 1.7.7 as soon as possible. There are no known workarounds.

Why it matters now

EPSS 0.01418 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed PatrowlManager (Patrowl): 1.7.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PatrowlPatrowlManagerbefore 1.7.71.7.7Patch availableCNA
  • PatrowlManager VendorPatrowl Affected before 1.7.7 Fixed in 1.7.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:patrowl:patrowlmanager:*:*:*:*:*:*:*:*before 1.7.7VulnerablePatrowl
  • cpe:2.3:a:patrowl:patrowlmanager:*:*:*:*:*:*:*:* Versions before 1.7.7 Vulnerable ·Patrowl

Remediation

  • Fix · CNA PatrowlManager (Patrowl) Fixed in 1.7.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43828

References

Exploit 1

Advisory 1

  • TI-2021-19635 Unrestricted Upload of Files in Patrowl CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences