CVE-2021-42338
Assigner: twcert
Published: 2021-11-19T00:00:00
State: PUBLISHED
affected: product: GCB Doctor
vendor: 4MOSAn
versions: lessThanOrEqual: 20210708(v2.0)
status: affected
version: unspecified
versionType: custom
datePublic: 2021-11-19T00:00:00
descriptions: value: 4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbitrary files.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-285
description: CWE-285 Improper Authorization
type: CWE
solutions: value: Update 4MOSAn GCB Doctor version to 20210811 (v2.0)
source: advisory: TVN-202111002
discovery: EXTERNAL
title: 4MOSAn GCB Doctor - Improper Authorization
x_generator: engine: Vulnogram 0.0.9