by Kastro
Paper/Archive/CVE-2021-22860

CVE-2021-22860

Excellent Infotek Corporation e-document system — EIC e-document system - Broken Authentication

EPSS 3%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.1.851 × 2017.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary commends.

Affected

ProductAffectedFixed inSource
e-document system0 3.0.2–CNA
e-document system0 2.9–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-4518-c813c-1.htmlrefgist.github.com/tonykuo76/17d497b3472a80a5e8914227e81e6fa3refchtsecurity.com/news/12929036-924b-4b89-8a0e-3e7155e19011