Vulnerability · Published Jul 30, 2021 · Assigned by mitre

CVE-2021-35193

High 7.5

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.2%top 32.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers' installations (that have the same software version). This provides remote access to SQL database credentials. (In the normal use of the product, retrieving those credentials only occurs after a username/password authentication step; however, this authentication step is on the client side, and an attacker can develop their own client that skips this step.)

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

http://patterson.eaglesoft.net/Home/Contact-Us x_refsource_MISC
https://justinshafer.blogspot.com/2021/07/eaglesoft-18-through-21-vulnerability.html x_refsource_MISC
https://github.com/jshafer817/Eaglesoft x_refsource_MISC