CVE-2021-42331CWE-285

ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-2

Medium · published October 15, 2021

CVSS v3.1
5.4
EPSS
1%
Percentile
50.1
In the wild
Unconfirmed
What it is

The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00641 · 50.1th percentile
Weakness
CWE-285 · Improper Authorization
Published
2021-10-15T12:10Z
EPSS history
Timeline
  • 15 OCT 12:10Z
    ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-2
    cvelistv5