CVE-2021-37214CWE-706

Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3

High · published August 9, 2021

CVSS v3.1
8.8
EPSS
1%
Percentile
64.4
In the wild
Unconfirmed
What it is

The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator privilege and execute arbitrary command.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01064 · 64.4th percentile
Weakness
CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published
2021-08-09T09:15Z
EPSS history
Timeline
  • 09 AUG 09:15Z
    Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3
    cvelistv5