PT-2021-21597 · Unknown · Cms Enterprise Website Construction System

Published 2021-09-27 · Updated 2021-10-06 · CVE-2021-37270

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CMS Enterprise Website Construction System version 5.0

Description The issue allows attackers to gain unauthorized access to the background administrator authority without logging in. This is achieved by directly accessing a specified background path.

Recommendations For CMS Enterprise Website Construction System version 5.0, consider restricting access to the background path until a patch is available. As a temporary workaround, limit the access to the background administrator authority to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-37270

Affected Products

Cms Enterprise Website Construction System

References · 5

• https://osv.dev/vulnerability/CVE-2021-37270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37270 · Security Note
• https://t.me/cibsecurity/29525 · Telegram Post
• https://cnvd.org.cn/flaw/show/2815129 · Note
• ❌ https://github.com/purple-WL/S-cms-Unauthorized · Note, Deleted