PT-2025-44459 · Seeyon · Seeyon Zhiyuan Oa

CVE-2021-4461 · Publicado 2025-10-30 · Atualizado 2025-11-28

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1

Description The software does not properly decode and parse the enc parameter in the thirdpartyController.do endpoint. The decoded map values can influence session attributes without sufficient authentication or authorization checks, allowing attackers to assign a session to arbitrary user IDs. This issue has been observed being exploited in the wild. The vulnerable endpoint is /thirdpartyController.do. The enc parameter is vulnerable.

Recommendations Versions prior to 7.0 SP1 should be used.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2021-4461

Produtos afetados

Seeyon Zhiyuan Oa

Referências · 9

• 🔥 https://github.com/projectdiscovery/nuclei-templates/blob/1ca6b8e6fe225cbd46dcb893dcaee01447afa8c0/http/misconfiguration/seeyon-unauth.yaml#L20 · Exploit
• 🔥 https://github.com/chaitin/xray/blob/f90cf321bc4d294bbf6625a9c4853f3bfdf0a384/pocs/seeyon-oa-cookie-leak.yml · Exploit
• 🔥 https://mp.weixin.qq.com/s/0AqdfTrZUVrwTMbKEKresg · Exploit
• https://t.me/cveNotify/144288 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2021-4461 · Aviso do Fabricante
• https://vulncheck.com/advisories/seeyon-zhiyuan-oa-web-application-system-authentication-bypass · Nota
• https://twitter.com/CVEnew/status/1984012732669002106 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/1984008542605475928 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2021-4461 · Nota de Segurança