VULNERABILITY INTELLIGENCE

CVE-2021-36389

CVSS score7.5 HIGH

EPSS probability3.09%

CISA KEVNot currently listed

Published2021-10-14

Last modified2026-06-17

Description

In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".