CVE-2021-41553

{"id": "CVE-2021-41553", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-10-05T16:15:07.593", "references": [{"url": "https://www.gruppotim.it/redteam", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the testers to modify the application logic. It is also possible to set the value of the session token, client-side, simply by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field. The application, following the login, does not assign a new token, continuing to keep the inserted one, as the identifier of the entire session. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020"}, {"lang": "es", "value": "** NO SOPORTADO CUANDO SE ASIGN\u00d3 ** En ARCHIBUS Web Central 21.3.3.815 (una versi\u00f3n de 2014), la aplicaci\u00f3n web en /archibus/login.axvw asigna un token de sesi\u00f3n que podr\u00eda estar ya en uso por otro usuario. Por lo tanto, era posible acceder a la aplicaci\u00f3n a trav\u00e9s de un usuario cuyas credenciales no se conoc\u00edan, sin que los probadores intentaran modificar la l\u00f3gica de la aplicaci\u00f3n. Tambi\u00e9n es posible establecer el valor del token de sesi\u00f3n, del lado del cliente, simplemente haciendo una solicitud GET no autenticada a la p\u00e1gina de inicio y a\u00f1adiendo un valor arbitrario al campo JSESSIONID. La aplicaci\u00f3n, tras el inicio de sesi\u00f3n, no asigna un nuevo token, continuando con el insertado, como identificador de toda la sesi\u00f3n. Esto est\u00e1 solucionado en todas las versiones recientes, como la versi\u00f3n 26. NOTA: Esta vulnerabilidad s\u00f3lo afecta a los productos que ya no son soportados por el mantenedor. La versi\u00f3n 21.3 dej\u00f3 de recibir soporte oficialmente a finales de 2020"}], "lastModified": "2024-04-11T01:13:00.787", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:archibus:web_central:21.3.3.815:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99192A58-5724-427F-8824-3A1F5BE350C5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}