CVE-2021-37364

{"id": "CVE-2021-37364", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-10-26T14:15:07.687", "references": [{"url": "https://sourceforge.net/projects/open-clinic/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://sourceforge.net/projects/open-clinic/files/latest/download", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/50448", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://sourceforge.net/projects/open-clinic/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://sourceforge.net/projects/open-clinic/files/latest/download", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/50448", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues."}, {"lang": "es", "value": "OpenClinic GA versi\u00f3n 5.194.18, est\u00e1 afectado por Permisos Inseguros. Por defecto, el grupo de usuarios autenticados presenta el permiso de modificaci\u00f3n de las carpetas/archivos de OpenClinic. Una cuenta de bajo privilegio es capaz de renombrar los archivos mysqld.exe o tomcat8.exe ubicados en las carpetas bin y reemplazarlos con un archivo malicioso que se conectar\u00eda de nuevo a un equipo atacante dando privilegios a nivel de sistema (nt authority\\system) debido a que el servicio es ejecutado como Sistema Local. Mientras que un usuario poco privilegiado no puede reiniciar el servicio mediante la aplicaci\u00f3n, un reinicio del ordenador desencadena una ejecuci\u00f3n del archivo malicioso. La aplicaci\u00f3n tambi\u00e9n presenta problemas de ruta de servicio no citada"}], "lastModified": "2024-11-21T06:15:00.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openclinic_ga_project:openclinic_ga:5.194.18:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF76DCF5-6210-4357-B8B4-C9C05D39A833"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}