CVE-2021-42330CWE-285

ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1

High · published October 15, 2021

CVSS v3.1
8.8
EPSS
1%
Percentile
61.9
In the wild
Unconfirmed
What it is

The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00981 · 61.9th percentile
Weakness
CWE-285 · Improper Authorization
Published
2021-10-15T12:10Z
EPSS history
Timeline
  • 15 OCT 12:10Z
    ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1
    cvelistv5