CVE-2021-45917
Assigner: twcert
Published: 2021-12-30T00:00:00
State: PUBLISHED
affected: product: Shockwall
vendor: SUN & MOON RISE CO., LTD.
versions: lessThan: 7.20.0401
status: affected
version: unspecified
versionType: custom
datePublic: 2021-12-30T00:00:00
descriptions: value: The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within the local area network can use the local registry information to launch server-side request forgery (SSRF) attack on another agent computer, resulting in arbitrary code execution for controlling the system or disrupting service.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-287
description: CWE-287 Improper Authentication
type: CWE
solutions: value: Contact tech support from SUN & MOON RISE CO., LTD.
source: advisory: TVN-202109021
discovery: EXTERNAL
title: SUN & MOON RISE CO., LTD. Shockwall - Improper Authentication
x_generator: engine: Vulnogram 0.0.9