Vulnerability · Published Feb 17, 2021 · Assigned by twcert
CVE-2021-22853Soar Cloud System Co., Ltd. HR Portal - Broken Access Control
Medium 5.4
In plain English
A medium-severity improper access control in HR Portal from Soar Cloud System Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.0%top 35.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to work.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Soar Cloud System Co., Ltd. | HR Portal | 0 7.3.2020.1013 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
References
- https://www.twcert.org.tw/tw/cp-132-4403-8eb68-1.html x_refsource_MISC
- https://www.chtsecurity.com/news/d334641f-2b28-4eab-a5ed-c6ec6740557e x_refsource_CONFIRM