Vulnerability · Published Jan 27, 2022 · Assigned by TR-CERT
CVE-2021-44795Modifying User Permissions via Unauthorized Access in Single Connect
Medium 5.3
In plain English
A medium-severity missing authorization in Single Connect from Kron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.9%top 39.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Single Connect does not perform an authorization check when using the "sc-assigned-credential-ui" module. A remote attacker could exploit this vulnerability to modify users permissions. The exploitation of this vulnerability might allow a remote attacker to delete permissions from other users without authenticating.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kron | Single Connect | unspecified – before 2.16 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.usom.gov.tr/bildirim/tr-22-0093 government-resource, broken-link
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-22-0093 government-resource