CVE-2021-41974

Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission.

CVSS v3 9.1 CRITICAL
CVSS v2.0 6.4 MEDIUM

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://www.twcert.org.tw/tw/cp-132-5173-e21ba-1.html	Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-5173-e21ba-1.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tad_book3_project:tad_book3:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:27

Type	Values Removed	Values Added
References	~~() https://www.twcert.org.tw/tw/cp-132-5173-e21ba-1.html - Third Party Advisory~~	() https://www.twcert.org.tw/tw/cp-132-5173-e21ba-1.html - Third Party Advisory

Information

Published : 2021-10-08 16:15

Updated : 2024-11-21 06:27

NVD link : CVE-2021-41974

Mitre link : CVE-2021-41974

CVE.ORG link : CVE-2021-41974

JSON object : View

Products Affected

tad_book3_project

tad_book3

CWE

CWE-285

Improper Authorization

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2021-41974", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2021-10-08T16:15:08.437", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-5173-e21ba-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-5173-e21ba-1.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-285"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission."}, {"lang": "es", "value": "La p\u00e1gina de edici\u00f3n de libros de Tad Book3 no lleva a cabo una verificaci\u00f3n de identidad. Unos atacantes remotos pueden usar la vulnerabilidad para visualizar y modificar el contenido arbitrario de los libros sin permiso"}], "lastModified": "2024-11-21T06:27:00.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tad_book3_project:tad_book3:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C69D5E7-279F-4C62-BD0C-2CEC5AC37477", "versionEndExcluding": "3.9"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}