PT-2021-15233 · Unknown · Eic E-Document System

Tony Kuo · Published 2021-03-17 · Updated 2021-03-23 · CVE-2021-22860

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EIC e-document system (affected versions not specified)

Description The issue concerns the EIC e-document system, which fails to perform complete identity verification for sorting and filtering personnel data. This allows a remote attacker to obtain user credential information without logging into the system, potentially leading to the acquisition of privileged permissions and the execution of arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-22860

Affected Products

Eic E-Document System

References · 5

• https://osv.dev/vulnerability/CVE-2021-22860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22860 · Security Note
• https://twcert.org.tw/tw/cp-132-4518-c813c-1.html · Note
• https://chtsecurity.com/news/12929036-924b-4b89-8a0e-3e7155e19011 · Note
• https://gist.github.com/tonykuo76/17d497b3472a80a5e8914227e81e6fa3 · Note