Lucene search

TwcertCVE-2021-37215

HistoryAug 09, 2021 - 10:15 a.m.

CVE-2021-37215

2021-08-0910:15:08

CWE-706

CWE-639

twcert

web.nvd.nist.gov

cve-2021-37215

flygo

insecure direct object reference

idor

api parameter

user data manipulation

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

37.0%

JSON

The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s user data by specifying that employee’s ID in the API parameter.

Affected configurations

Nvd

Node

larvataflygoRange<1.91.1

VendorProductVersionCPE
larvataflygo*cpe:2.3:a:larvata:flygo:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
larvata	flygo	*	cpe:2.3:a:larvata:flygo::::::::

CNA Affected

[
  {
    "product": "FLYGO",
    "vendor": "Larvata Digital Technology Co. Ltd.",
    "versions": [
      {
        "lessThanOrEqual": "2021.4e",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-4992-dac66-1.html

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

37.0%

JSON

Related for CVE-2021-37215