CVE-2021-41847

{"id": "CVE-2021-41847", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-10-01T23:15:07.313", "references": [{"url": "https://gitlab.com/grose88/infinias", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://grant-rose.com/infinias-access-control-vulnerability/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.3xlogic.com/infinias-access-control", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://gitlab.com/grose88/infinias", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://grant-rose.com/infinias-access-control-vulnerability/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.3xlogic.com/infinias-access-control", "tags": ["Product", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and Prox card credentials. Also, an authorized user of one zone can send API requests to unlock electronic locks associated with zones they are unauthorized to have access to. They can also create new user logins for zones they were not authorized to access, including the root zone of the software."}, {"lang": "es", "value": "Se ha detectado un problema en 3xLogic Infinias Access Control versiones hasta 6.7.10708.0, que afecta a la seguridad f\u00edsica. Los usuarios con credenciales de inicio de sesi\u00f3n asignados a una zona espec\u00edfica pueden enviar peticiones HTTP GET y POST modificadas, lo que les permite visualizar datos de usuario como informaci\u00f3n personal y credenciales de tarjetas Prox. Adem\u00e1s, un usuario autorizado de una zona puede enviar peticiones API para desbloquear cerraduras electr\u00f3nicas asociadas a zonas a las que no est\u00e1 autorizado a acceder. Tambi\u00e9n pueden crear nuevos inicios de sesi\u00f3n de usuarios para zonas a las que no estaban autorizados a acceder, incluida la zona root del software"}], "lastModified": "2024-11-21T06:26:53.493", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:3xlogic:infinias_access_control:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79C52797-BEF6-4F0F-A21C-71C734E9986B", "versionEndIncluding": "6.7.10708.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}