PT-2021-20642 · Unknown · E-Document System

Published 2021-06-16 · Updated 2021-06-24 · CVE-2021-34683

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: E-document System version 3.0

Description: A remote attacker can exploit the issue to obtain the contact information, including names and e-mail addresses, of all users within an organization. This can be achieved through the "kw/auth/bbs/asp/get user email info bbs.asp" API endpoint. The exposed information may facilitate social engineering or brute force attacks against the system's login page.

Recommendations: For version 3.0, restrict access to the "kw/auth/bbs/asp/get user email info bbs.asp" API endpoint to prevent unauthorized information disclosure. Consider implementing additional security measures to protect against social engineering and brute force attacks.

Exploit

Fix

Related Identifiers

CVE-2021-34683

Affected Products

E-Document System

References · 4

• 🔥 https://github.com/ethancsyang/CveProject/tree/main/CVE-2021-34683 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-34683 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34683 · Vendor Advisory
• https://eic.com.tw/eicHome/pro00.html · Vendor Advisory