PT-2021-21967 · Wipro · Wipro Holmes Orchestrator

Published 2021-11-29 · Updated 2021-11-30 · CVE-2021-38147

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Wipro Holmes Orchestrator version 20.4.1 (20.4.1 02 11 2020)

Description: The issue allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to several endpoints, including "processexecution/DownloadExcelFile/Domain Credential Report Excel", "processexecution/DownloadExcelFile/User Report Excel", "processexecution/DownloadExcelFile/Process Report Excel", "processexecution/DownloadExcelFile/Infrastructure Report Excel", or "processexecution/DownloadExcelFile/Resolver Report Excel".

Recommendations: As a temporary workaround, consider disabling access to the processexecution/DownloadExcelFile API endpoints until a patch is available. Restrict access to these endpoints to minimize the risk of exploitation. Avoid using these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-38147

Affected Products

Wipro Holmes Orchestrator

References · 5

• 🔥 http://packetstormsecurity.com/files/165039/Wipro-Holmes-Orchestrator-20.4.1-Report-Disclosure.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38147 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38147 · Vendor Advisory
• https://t.me/cibsecurity/33022 · Telegram Post
• https://wipro.com/holmes · Note