CVE-2021-41554

{"id": "CVE-2021-41554", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-10-05T15:15:07.850", "references": [{"url": "https://www.gruppotim.it/redteam", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affected endpoints: /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw, /archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw. By not verifying the permissions for access to resources, it allows a potential attacker to view pages that are not allowed. Specifically, it was found that any authenticated user can reach the administrative console for user management by directly requesting access to the page via URL. This allows a malicious user to modify all users' profiles, to elevate any privileges to administrative ones, or to create or delete any type of user. It is also possible to modify the emails of other users, through a misconfiguration of the username parameter, on the user profile page. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020"}, {"lang": "es", "value": "** NO SOPORTADO CUANDO SE ASIGN\u00d3 ** ARCHIBUS Web Central 21.3.3.815 (una versi\u00f3n de 2014) no valida correctamente las solicitudes de acceso a los datos y la funcionalidad en estos puntos finales afectados: /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw, /archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw. Al no verificar los permisos de acceso a los recursos, permite a un potencial atacante ver p\u00e1ginas no permitidas. En concreto, se ha detectado que cualquier usuario autentificado puede llegar a la consola administrativa de gesti\u00f3n de usuarios solicitando directamente el acceso a la p\u00e1gina a trav\u00e9s de la URL. Esto permite a un usuario malicioso modificar los perfiles de todos los usuarios, elevar cualquier privilegio a administrativo o crear o eliminar cualquier tipo de usuario. Tambi\u00e9n es posible modificar los correos electr\u00f3nicos de otros usuarios, a trav\u00e9s de una mala configuraci\u00f3n del par\u00e1metro nombre de usuario, en la p\u00e1gina de perfil de usuario. Esto est\u00e1 solucionado en todas las versiones recientes, como la versi\u00f3n 26. NOTA: Esta vulnerabilidad s\u00f3lo afecta a los productos que ya no est\u00e1n soportados por el mantenedor. La versi\u00f3n 21.3 dej\u00f3 de recibir soporte oficialmente a finales de 2020."}], "lastModified": "2024-04-11T01:13:00.853", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:archibus:web_central:21.3.3.815:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99192A58-5724-427F-8824-3A1F5BE350C5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}