GHSA-JGJR-5RHG-5C7W高危未审查

无摘要

OSV 1.4.0 · unreviewed · 修改于 2022-08-10 08:00

发布时间

2021-12-08 08:01

GitHub 审查时间

—

NVD 发布时间

2021-12-08 02:15

源文件

advisories/unreviewed/2021/12/GHSA-jgjr-5rhg-5c7w/GHSA-jgjr-5rhg-5c7w.json

公告说明

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

受影响的软件包

该公告没有提供结构化的受影响软件包信息。

参考链接

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-43175

标识信息

别名 / CVE

CVE-2021-43175

CWE

CWE-287

软件生态

无

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-jgjr-5rhg-5c7w",
  "aliases": [
    "CVE-2021-43175"
  ],
  "details": "The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
  "affected": [],
  "modified": "2022-08-10T00:00:30Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2021-12-08T00:01:04Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43175",
      "type": "ADVISORY"
    },
    {
      "url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "nvd_published_at": "2021-12-07T18:15:00Z",
    "github_reviewed_at": null
  }
}