CVE-2021-36801 Akaunting Authentication Bypass in Company Selection

2021-08-0422:20:40

CWE-639

rapid7

www.cve.org

akaunting

authentication bypass

cve-2021-36801

user-controllable field

company selection

version 2.1.12

version 2.1.13

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

32.1%

JSON

Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product.

CNA Affected

[
  {
    "product": "Akaunting",
    "vendor": "Akaunting",
    "versions": [
      {
        "lessThanOrEqual": "2.1.12",
        "status": "affected",
        "version": "2.1.12",
        "versionType": "custom"
      }
    ]
  }
]