CVE-2021-22860

Published: Mar 17, 2021

Modified: Sep 16, 2024

PUBLISHED

CVSS v3.1

9.8

CRITICAL

Description

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary commends.

Vendor	Product	Versions
Excellent Infotek Corporation	e-document system	affected `0 3.0.2` affected `0 2.9`

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

https://www.twcert.org.tw/tw/cp-132-4518-c813c-1.html

x_refsource_MISC

https://gist.github.com/tonykuo76/17d497b3472a80a5e8914227e81e6fa3

x_refsource_MISC

https://www.chtsecurity.com/news/12929036-924b-4b89-8a0e-3e7155e19011

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2021-22860

Description

Affected Products

CVSS v3.1 Details

References