CVE-2021-41744

All versions of yongyou PLM are affected by a command injection issue. UFIDA PLM (Product Life Cycle Management) is a strategic management method. It applies a series of enterprise application systems to support the entire process from conceptual design to the end of product life, and the collaborative creation, distribution, application and management of product information across organizations. Yonyou PLM uses jboss by default, and you can access the management control background without authorization An attacker can use this vulnerability to gain server permissions.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.cnvd.org.cn/flaw/show/CNVD-2021-39097	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:yonyou:ufida_product_lifecycle_management:-:*:*:*:*:*:*:*

History

28 Oct 2021, 19:19

Type	Values Removed	Values Added
References	~~(MISC) https://www.cnvd.org.cn/flaw/show/CNVD-2021-39097 -~~	(MISC) https://www.cnvd.org.cn/flaw/show/CNVD-2021-39097 - Third Party Advisory
CPE		cpe:2.3:a:yonyou:ufida_product_lifecycle_management:-:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 7.5 v3 : 9.8
CWE		CWE-77

22 Oct 2021, 12:43

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-10-22 12:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-41744

Mitre link : CVE-2021-41744

CVE.ORG link : CVE-2021-41744

JSON object : View

Products Affected

yonyou

ufida_product_lifecycle_management

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2021-41744", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-10-22T12:15:09.063", "references": [{"url": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-39097", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "All versions of yongyou PLM are affected by a command injection issue. UFIDA PLM (Product Life Cycle Management) is a strategic management method. It applies a series of enterprise application systems to support the entire process from conceptual design to the end of product life, and the collaborative creation, distribution, application and management of product information across organizations. Yonyou PLM uses jboss by default, and you can access the management control background without authorization An attacker can use this vulnerability to gain server permissions."}, {"lang": "es", "value": "Todas las versiones de yongyou PLM est\u00e1n afectadas por un problema de inyecci\u00f3n de comandos. UFIDA PLM (Product Life Cycle Management) es un m\u00e9todo de administraci\u00f3n estrat\u00e9gica. Aplica una serie de sistemas de aplicaciones empresariales para apoyar todo el proceso, desde el dise\u00f1o conceptual hasta el final de la vida del producto, y la creaci\u00f3n, distribuci\u00f3n, aplicaci\u00f3n y administraci\u00f3n de la informaci\u00f3n del producto en colaboraci\u00f3n con todas las organizaciones. Yonyou PLM usa jboss por defecto, y puede acceder al fondo de control de administraci\u00f3n sin autorizaci\u00f3n. Un atacante puede usar esta vulnerabilidad para conseguir permisos de servidor"}], "lastModified": "2021-10-28T19:19:48.443", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:yonyou:ufida_product_lifecycle_management:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FADC21E5-27D5-42DB-8345-A8194EF13712"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}