Lucene search

[email protected]CVE-2021-22860

HistoryMar 17, 2021 - 9:15 a.m.

CVE-2021-22860

2021-03-1709:15:12

CWE-287

[email protected]

web.nvd.nist.gov

cve-2021-22860

eic e-document system

security vulnerability

identity verification

remote access

arbitrary commands

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

82.3%

JSON

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary commends.

Affected configurations

NVD

Node

eice-document_systemMatch2.9

eice-document_systemMatch3.0.2

CPENameOperatorVersion
eic:e-document_systemeic e-document systemeq2.9
eic:e-document_systemeic e-document systemeq3.0.2

CPE	Name	Operator	Version
eic:e-document_system	eic e-document system	eq	2.9
eic:e-document_system	eic e-document system	eq	3.0.2

CNA Affected

[
  {
    "product": "e-document system",
    "vendor": "Excellent Infotek Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "0 3.0.2"
      },
      {
        "status": "affected",
        "version": "0 2.9"
      }
    ]
  }
]

References

gist.github.com/tonykuo76/17d497b3472a80a5e8914227e81e6fa3

www.chtsecurity.com/news/12929036-924b-4b89-8a0e-3e7155e19011

www.twcert.org.tw/tw/cp-132-4518-c813c-1.html

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

82.3%

JSON

Related for CVE-2021-22860

cvelist1 prion1 nvd1