PT-2021-23327 · Archibus · Archibus Web Central

Alessandro Sabetta + 3 · Published 2021-10-05 · Updated 2024-08-04 · CVE-2021-41553

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ARCHIBUS Web Central versions 21.3.3.815 and earlier

Description The issue arises from the Web Application in /archibus/login.axvw, where a session token could be assigned that is already in use by another user. This allowed access to the application without knowing the user's credentials. It was also possible to set the value of the session token client-side by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field. The application did not assign a new token after login, continuing to use the inserted one as the session identifier. This vulnerability only affects products that are no longer supported by the maintainer.

Recommendations For ARCHIBUS Web Central versions 21.3.3.815 and earlier, update to a version newer than 21.3, such as version 26, to resolve the issue. As a temporary workaround, consider restricting access to the /archibus/login.axvw endpoint to minimize the risk of exploitation. Avoid using the JSESSIONID field in the affected API endpoint until the issue is resolved.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2021-41553

Affected Products

Archibus Web Central

References · 5

• https://osv.dev/vulnerability/CVE-2021-41553 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41553 · Security Note
• https://t.me/cvenotify/88909 · Telegram Post
• https://t.me/cibsecurity/29996 · Telegram Post
• https://gruppotim.it/redteam · Note