CVE-2021-42115 - Vulnerability Details - OpenCVE

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Businessdnasolutions	Topease

Configuration 1 [-]

cpe:2.3:a:businessdnasolutions:topease:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://confluence.topease.ch/confluence/display/DOC/Release+Notes

History

No history.

MITRE

Status: PUBLISHED

Assigner: NCSC.ch

Published: 2021-11-30T11:28:07

Updated: 2024-08-04T03:22:25.999Z

Reserved: 2021-10-08T00:00:00

Link: CVE-2021-42115

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-11-30T12:15:07.647

Modified: 2024-11-21T06:27:17.537

Link: CVE-2021-42115

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:businessdnasolutions:topease:*:*:*:*:*:*:*:*", "matchCriteriaId": "5586486C-6AB4-4357-A17C-7957140EAB27", "versionEndIncluding": "7.1.27", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH\u2019s TopEase\u00ae Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID."}, {"lang": "es", "value": "La falta del flag HTTPOnly en las aplicaciones web que operan en la plataforma TopEase\u00ae de Business-DNA Solutions GmbH, versiones anteriores a 7.1.27 incluy\u00e9ndola, permite a un atacante remoto no autenticado escalar los privilegios de un usuario no autenticado a uno autenticado por medio del robo y la inyecci\u00f3n del UID de la cookie est\u00e1tica e independiente de la sesi\u00f3n"}], "id": "CVE-2021-42115", "lastModified": "2024-11-21T06:27:17.537", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "vulnerability@ncsc.ch", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-11-30T12:15:07.647", "references": [{"source": "vulnerability@ncsc.ch", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://confluence.topease.ch/confluence/display/DOC/Release+Notes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://confluence.topease.ch/confluence/display/DOC/Release+Notes"}], "sourceIdentifier": "vulnerability@ncsc.ch", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1004"}], "source": "vulnerability@ncsc.ch", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}]}