PT-2021-23106 · Unknown · Survey Solutions

Vavalomi · Published 2021-10-04 · Updated 2022-08-12 · CVE-2021-41123

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Survey Solutions versions prior to 21.09.1

Description The issue concerns the Headquarters application of Survey Solutions, a survey management and data collection system. In affected versions, the /metrics endpoint is published and available to any user. This endpoint exposes aggregate counters, including the count of interviews or assignments, but does not expose survey answers.

Recommendations For versions prior to 21.09.1, consider disabling the /metrics endpoint to prevent unauthorized access to aggregate counters until a version with the endpoint turned off by default can be implemented.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-41123

GHSA-6C7J-7JF3-9P3J

Affected Products

Survey Solutions

References · 6

• https://github.com/surveysolutions/surveysolutions/commit/99e7e8345cb98f2eda08e37976e3d3aeb49971c9 · Patch
• https://osv.dev/vulnerability/CVE-2021-41123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41123 · Security Note
• https://github.com/surveysolutions/surveysolutions/security/advisories/GHSA-6c7j-7jf3-9p3j · Note
• https://t.me/cvenotify/21904 · Telegram Post
• https://t.me/cibsecurity/29949 · Telegram Post