Vulnerability · Published Jan 27, 2022 · Assigned by TR-CERT
CVE-2021-44792Information Leakege via Unauthorized Access in Single Connect
Medium 5.3
In plain English
A medium-severity missing authorization in Single Connect from Kron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.0%top 37.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Single Connect does not perform an authorization check when using the "log-monitor" module. A remote attacker could exploit this vulnerability to access the logging interface. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kron | Single Connect | unspecified – before 2.16 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.usom.gov.tr/bildirim/tr-22-0093 government-resource, broken-link
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-22-0093 government-resource