CVE-2021-41123CWE-200

Exposure of Sensitive Information to an Unauthorized Actor in WB.UI.Headquarters.dll

Medium · published October 4, 2021

CVSS v3.1
5.3
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments. Starting from version 21.09.1 the endpoint is turned off by default.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00881 · 58.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-10-04T22:30Z
EPSS history
Timeline
  • 04 OCT 22:30Z
    Exposure of Sensitive Information to an Unauthorized Actor in WB.UI.Headquarters.dll
    cvelistv5