CVE-2021-45900

{"id": "CVE-2021-45900", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-03-30T22:15:08.447", "references": [{"url": "https://vivoh.com/blog/finra-remediation/", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://vivoh.com/wp-content/uploads/2021/11/Vivoh-Webinar-Manager-for-Zoom-Installation-and-Administration-Guide.pdf", "tags": ["Broken Link"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie is assigned so that they can be uniquely identified. Certain APIs can be successfully executed without proper authentication. This can let an attacker impersonate as victim and make state changing requests on their behalf."}, {"lang": "es", "value": "Vivoh Webinar Manager versiones anteriores a 3.6.3.0, presenta una autenticaci\u00f3n inapropiada de la API. Cuando un usuario es registrado en el portlet web de configuraci\u00f3n de la administraci\u00f3n, le es asignada una cookie VIVOH_AUTH para que pueda ser identificado de forma \u00fanica. Algunas APIs pueden ser ejecutadas con \u00e9xito sin una autenticaci\u00f3n apropiada. Esto puede permitir a un atacante hacerse pasar por la v\u00edctima y realizar peticiones de cambio de estado en su nombre"}], "lastModified": "2022-04-06T00:14:01.320", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vivoh:webinar_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70919639-2855-4666-9DAF-0A083CFE01A6", "versionEndExcluding": "3.6.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}