CVE-2021-32794

🗓️ 26 Jul 2021 18:55:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 93 Views🌐 WEB

Archisteamfarm C# application vulnerability in updating global ASF config may allow unauthorized IPC interface acces

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2021-32794	26 Jul 202119:15	–	attackerkb
Circl	CVE-2021-32794	26 Jul 202122:11	–	circl
CNNVD	ArchiSteamFarm Access Control Vulnerability	26 Jul 202100:00	–	cnnvd
Cvelist	CVE-2021-32794 Accidental removal of IPCPassword (< 5.1.2.4)	26 Jul 202118:55	–	cvelist
EUVD	EUVD-2021-19557	7 Oct 202500:30	–	euvd
Mend	CVE-2021-32794	26 Jul 202118:55	–	mend
NVD	CVE-2021-32794	26 Jul 202119:15	–	nvd
Prion	Design/Logic Flaw	26 Jul 202119:15	–	prion
Positive Technologies	PT-2021-19936	26 Jul 202100:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2021-32794: Improper Authentication	26 Jul 202100:00	–	rapid7

NVD

Vulners

Node

archisteamfarm_project archisteamfarmRange<5.1.2.4

[
  {
    "product": "ArchiSteamFarm",
    "vendor": "JustArchiNET",
    "versions": [
      {
        "status": "affected",
        "version": "< 5.1.2.4"
      }
    ]
  }
]

Source	Link
steamcommunity	www.steamcommunity.com/groups/archiasf/discussions/6/3057365873428498659/
github	www.github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-wxx4-66c2-vj2v
github	www.github.com/JustArchiNET/ArchiSteamFarm/pull/2379

Parameter	Position	Path	Description	CWE
IPCPassword	request body	/Api/ASF	The ASF API endpoint incorrectly removes the IPCPassword security measure from the global configuration when it is not explicitly specified in the request body.	CWE-287, CWE-306