PT-2021-19235 · 1с · 1С:Предприятие+1

Irina Belyaeva · Published 2021-01-13 · Updated 2025-07-30 · CVE-2021-3131

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 1C:Enterprise 8 versions prior to 8.3.17.1851

Description The issue concerns the Web server in 1C:Enterprise 8, which sends base64 encoded credentials in the creds URL parameter.

Recommendations For versions prior to 8.3.17.1851, update to version 8.3.17.1851 or later to resolve the issue.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2021-3131

Affected Products

1С:Предприятие

1С

References · 4

• 🔥 https://github.com/jet-pentest/CVE-2021-3131 · Exploit
• https://osv.dev/vulnerability/CVE-2021-3131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3131 · Security Note
• https://t.me/cibsecurity/22087 · Telegram Post