PT-2021-23749 · Forma Lms · Forma Lms

Published 2021-11-10 · Updated 2022-07-12 · CVE-2021-43136

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FormaLMS versions 2.4.4 and earlier

Description An authentication bypass issue allows an attacker to bypass the authentication mechanism and obtain valid access to the platform.

Recommendations For FormaLMS versions 2.4.4 and earlier, update to a version later than 2.4.4 to resolve the issue.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-43136

Affected Products

Forma Lms

References · 9

• 🔥 https://blog.hacktivesecurity.com/index.php/2021/10/05/cve-2021-43136-formalms-the-evil-default-value-that-leads-to-authentication-bypass · Exploit
• 🔥 https://exploit-db.com/exploits/50513 · Exploit
• 🔥 http://packetstormsecurity.com/files/164930/FormaLMS-2.4.4-Authentication-Bypass.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-43136 · Vendor Advisory
• https://formalms.org · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43136 · Security Note
• https://blog.hacktivesecurity.com · Note
• https://t.me/cibsecurity/32146 · Telegram Post
• https://t.me/defcon_news/89751 · Telegram Post