CVE-2021-46561
controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrator to transfer a user account to an arbitrary new organization, and thereby achieve unintended…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.84%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrator to transfer a user account to an arbitrary new organization, and thereby achieve unintended access within the context of that new organization.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.84% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- mitre/cve services
- Source
- cve@mitre.org
References
- https://github.com/CVEProject/cve-services/commit/5c50baf3bda28133a3bc90b854765a64fb538304Patch, Third Party Advisory
- https://github.com/CVEProject/cve-services/commit/5c50baf3bda28133a3bc90b854765a64fb538304Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.