CVE-2021-46086

{"id": "CVE-2021-46086", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-01-25T16:15:08.967", "references": [{"url": "https://github.com/mindskip/xzs-mysql/issues/327", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnerability in the functional method of submitting examination papers. An attacker can use burpuite to modify parameters in the packet to destroy real data."}, {"lang": "es", "value": "xzs-mysql versiones posteriores a t3.4.0 incluy\u00e9ndola, es vulnerable a Permisos Inseguros. El front-end de este sistema de c\u00f3digo abierto es un sistema de ex\u00e1menes en l\u00ednea. Se presenta una vulnerabilidad no segura en el m\u00e9todo funcional de presentaci\u00f3n de ex\u00e1menes. Un atacante puede usar burpuite para modificar los par\u00e1metros del paquete para destruir los datos reales"}], "lastModified": "2022-01-31T20:04:36.447", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mindskip:xzs-mysql:t3.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C99B3E07-2A31-4AE7-BB5D-07CA2BF7299C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}