CVE-2021-36388

—

CVSS 3.1

7.5 high

EPSS

3%p87

Published

Oct 14, 2021 (Oct 14, 2021)

Modified

Jun 17, 2026

Description

In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".

Vendors: yellowfinbi
Products: yellowfin
Weakness: CWE-639
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (3.2%)

In the news0 stories

No ingested article mentions this CVE yet.