CVE-2021-42338
4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbitrary files.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 5.81% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-285, CWE-287
- Affected
- 4mosan/gcb doctor
- Source
- twcert@cert.org.tw
References
- https://www.twcert.org.tw/tw/cp-132-5313-45bde-1.htmlThird Party Advisory
- https://www.twcert.org.tw/tw/cp-132-5313-45bde-1.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.