Vulnerability · Published Dec 29, 2021 · Assigned by twcert

CVE-2021-44160Carinal Tien Hospital Health Report System - Authorization Bypass Through User-Controlled Key

High 7.3

In plain English

A high-severity authorization bypass via user-controlled key in Health Report System from Carinal Tien Hospital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)1.1%top 34.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the service partially unavailable to the user.

Affected products (as reported)

Vendor	Product	Versions
Carinal Tien Hospital	Health Report System	see references

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://www.twcert.org.tw/tw/cp-132-5429-4185b-1.html x_refsource_MISC