PT-2021-20213 · Unknown · Echo Sharecare

Nick Nam + 1 · Published 2021-07-13 · Updated 2021-07-15 · CVE-2021-33578

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Echo ShareCare version 8.15.5

Description The issue allows for SQL injection when processing remote input from both authenticated and unauthenticated users. This can lead to bypassing authentication, exfiltrating SQL records, and manipulating data.

Recommendations For Echo ShareCare version 8.15.5, consider restricting access to sensitive data and implementing input validation to prevent SQL injection attacks until a patch is available. As a temporary workaround, restrict access to the application from unauthenticated users to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-33578

Affected Products

Echo Sharecare

References · 3

• https://osv.dev/vulnerability/CVE-2021-33578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33578 · Security Note
• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0001.md · Note