VulnerabilityModified

CVE-2021-42332

After logging in with user’s privilege, remote attackers can access the content of other users’ message boards by crafting URL parameters.

MEDIUM 4.3EPSS 0.76%

Does this matter?

Lower severity and a low EPSS score (0.76%). Track it; it rarely justifies an emergency change on its own.

Description

The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the content of other users’ message boards by crafting URL parameters.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.76% probability · 53th percentile
CISA KEV: Not listed
Weakness: CWE-285
Affected: xinheinformation/xinhe teaching platform system
Source: twcert@cert.org.tw

References

https://www.twcert.org.tw/tw/cp-132-5202-49681-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-5202-49681-1.htmlThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.