CVE-2021-42337CWE-285

TVN-202110009

Medium · published November 16, 2021

CVSS v3.1
4.3
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00897 · 59.2th percentile
Weakness
CWE-285 · Improper Authorization
Published
2021-11-16T01:40Z
EPSS history
Timeline
  • 16 NOV 01:40Z
    TVN-202110009
    cvelistv5