VulnerabilityModified

CVE-2021-41974

Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission.

CRITICAL 9.1EPSS 1.26%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 1.26% probability · 68th percentile
CISA KEV: Not listed
Weakness: CWE-285, CWE-306
Affected: tad book3 project/tad book3
Source: twcert@cert.org.tw

References

https://www.twcert.org.tw/tw/cp-132-5173-e21ba-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-5173-e21ba-1.htmlThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.