VulnerabilityModified
CVE-2021-37270
There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0.
CRITICAL 9.8EPSS 1.49%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access the specified background path without logging in to the background to obtain the background administrator authority.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.49% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- s-cms/cms enterprise website construction system
- Source
- cve@mitre.org
References
- https://github.com/purple-WL/S-cms-UnauthorizedThird Party Advisory
- https://www.cnvd.org.cn/flaw/show/2815129Third Party Advisory
- https://github.com/purple-WL/S-cms-UnauthorizedThird Party Advisory
- https://www.cnvd.org.cn/flaw/show/2815129Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.