Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2021-41298

Опубликовано: 30 сент. 2021
Источник: nvd
CVSS3: 8.8
CVSS2: 6.5
EPSS Низкий

Описание

ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:ecoa:ecs_router_controller-ecs:-:*:*:*:*:*:*:*
Конфигурация 2

Одновременно

cpe:2.3:o:ecoa:riskbuster_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:ecoa:riskbuster:-:*:*:*:*:*:*:*
Конфигурация 3
cpe:2.3:a:ecoa:riskterminator:-:*:*:*:*:*:*:*

EPSS

Процентиль: 46%
0.00233
Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-284
CWE-639

Связанные уязвимости

github логотип

GHSA-7jxv-2xpm-95jx

github
больше 3 лет назад

ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.

EPSS

Процентиль: 46%
0.00233
Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-284
CWE-639