CVE-2021-37270

{"id": "CVE-2021-37270", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-09-27T21:15:07.927", "references": [{"url": "https://github.com/purple-WL/S-cms-Unauthorized", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.cnvd.org.cn/flaw/show/2815129", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/purple-WL/S-cms-Unauthorized", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.cnvd.org.cn/flaw/show/2815129", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use this vulnerability to directly access the specified background path without logging in to the background to obtain the background administrator authority."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de acceso no autorizado en CMS Enterprise Website Construction System versi\u00f3n 5.0. Unos atacantes pueden usar esta vulnerabilidad para acceder directamente a la ruta de fondo especificada sin iniciar sesi\u00f3n en el fondo para obtener la autoridad de administrador en segundo plano"}], "lastModified": "2024-11-21T06:14:55.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:s-cms:cms_enterprise_website_construction_system:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EEA82B7-0A98-4F40-8192-95060E55354A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}