PT-2021-22015 · Wipro · Wipro Holmes Orchestrator

Published 2021-11-22 · Updated 2022-07-12 · CVE-2021-38283

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Wipro Holmes Orchestrator version 20.4.1

Description: The issue allows remote attackers to read application log files containing sensitive information. This is achieved via a predictable "/log" URI.

Recommendations: For Wipro Holmes Orchestrator version 20.4.1, restrict access to the /log URI to prevent unauthorized reading of application log files. Consider implementing proper access controls and authentication mechanisms for sensitive areas of the application.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-38283

Affected Products

Wipro Holmes Orchestrator

References · 5

• 🔥 http://packetstormsecurity.com/files/165031/Wipro-Holmes-Orchestrator-20.4.1-File-Disclosure.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38283 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38283 · Vendor Advisory
• https://wipro.com/holmes · Note
• https://t.me/defcon_news/90476 · Telegram Post