Vulnerability · Published Nov 19, 2021 · Assigned by twcert
CVE-2021-423384MOSAn GCB Doctor - Improper Authorization
Critical 9.8
In plain English
A critical-severity security flaw in GCB Doctor from 4MOSAn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.8% (higher than 93% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)5.8%top 6.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in cookie, and arbitrarily manipulate the system or interrupt services by upload and execution of arbitrary files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 4MOSAn | GCB Doctor | unspecified – through 20210708(v2.0) |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-5313-45bde-1.html x_refsource_MISC