CVE-2021-42115

Опубликовано: 30 нояб. 2021

Источник: nvd

CVSS3: 8.1

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID.

Ссылки

https://confluence.topease.ch/confluence/display/DOC/Release+Notes
Release Notes
Vendor Advisory
https://confluence.topease.ch/confluence/display/DOC/Release+Notes
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:businessdnasolutions:topease:*:*:*:*:*:*:*:*

Версия до 7.1.27 (включая)

EPSS

Процентиль: 68%

0.00569

Низкий

8.1 High

CVSS3

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-1004

CWE-732

Связанные уязвимости

GHSA-hf8m-4ppx-hx3q

github

около 4 лет назад

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbHâ€™s TopEaseÂ® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID.

EPSS

Процентиль: 68%

0.00569

Низкий

8.1 High

CVSS3

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-1004

CWE-732