PT-2021-22248 · Eigen Nlp · Eigen Nlp

Thomas Pianezzola · Published 2021-09-07 · Updated 2022-07-12 · CVE-2021-38616

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eigen NLP version 3.10.1

Description A lack of access control on the "/auth/v1/user/{user-guid}/" user edition endpoint could permit any logged-in user to increase their own permissions via a user permissions array in a PATCH request. A guest user could modify other users' profiles and more.

Recommendations For Eigen NLP version 3.10.1, restrict access to the "/auth/v1/user/{user-guid}/" endpoint to prevent unauthorized modifications, and consider implementing proper access control to prevent users from increasing their own permissions via the user permissions array. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-38616

Affected Products

Eigen Nlp

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-38616 · Security Note
• https://eigentech.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38616 · Vendor Advisory
• https://excellium-services.com/cert-xlm-advisory/CVE-2021-38616 · Note
• https://excellium-services.com/cert-xlm-advisory · Note
• https://t.me/cibsecurity/28347 · Telegram Post
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38616 · Note