PT-2021-23760 · Unknown · Goautodial

Scott Tolley · Published 2021-12-07 · Updated 2022-08-09 · CVE-2021-43175

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GOautodial versions prior to commit 3c3a979

Description The issue concerns incorrect validation of the username and password parameters in the API router, allowing for successful authentication with any specified values.

Recommendations For versions prior to commit 3c3a979, update to a version that includes the fix made on October 13th, 2021, or later. As a temporary workaround, consider restricting access to the API router to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-305

Related Identifiers

CVE-2021-43175

Affected Products

Goautodial

References · 5

• 🔥 https://synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-43175 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43175 · Vendor Advisory
• https://t.me/cibsecurity/33487 · Telegram Post
• https://t.me/cibsecurity/33489 · Telegram Post