Lucene search

JpcertCVE-2021-20617

HistoryJan 14, 2021 - 9:15 a.m.

CVE-2021-20617

2021-01-1409:15:13

jpcert

web.nvd.nist.gov

cve-2021-20617

improper access control

acmailer

remote attack

admin privilege

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.008

Percentile

81.9%

JSON

Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified vectors.

Affected configurations

Nvd

Vulners

Node

acmaileracmailerRange≤4.0.1

acmaileracmailer_dbRange≤1.1.3

VendorProductVersionCPE
acmaileracmailer*cpe:2.3:a:acmailer:acmailer:*:*:*:*:*:*:*:*
acmaileracmailer_db*cpe:2.3:a:acmailer:acmailer_db:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
acmailer	acmailer	*	cpe:2.3:a:acmailer:acmailer::::::::
acmailer	acmailer_db	*	cpe:2.3:a:acmailer:acmailer_db::::::::

CNA Affected

[
  {
    "product": "acmailer and acmailer DB",
    "vendor": "Seeds Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN35906450/index.html

www.acmailer.jp/info/de.cgi?id=101

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.008

Percentile

81.9%

JSON

Related for CVE-2021-20617