PT-2021-24168 · Dalmark Systems · Systeam

Published 2021-12-21 · Updated 2022-07-12 · CVE-2021-44877

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Dalmark Systems Systeam version 2.22.8 build 1724

Description: The Systeam application, an ERP system with a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts, has a broken access control vulnerability. This vulnerability is found when using a temporary generated token to consume API resources, allowing an unauthenticated attacker to generate a temporary JWT token. The attacker can use this token to request system configuration parameters via direct API requests, resulting in sensitive information exposure. If the tenant has an SMTP credential set, the full credential information is disclosed.

Recommendations: For Dalmark Systems Systeam version 2.22.8 build 1724, consider disabling the use of temporary generated tokens for API resource consumption until a patch is available. Restrict access to API endpoints that allow generation of temporary JWT tokens to minimize the risk of exploitation. Avoid using direct API requests to request system configuration parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-44877

Affected Products

Systeam

References · 4

• https://osv.dev/vulnerability/CVE-2021-44877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44877 · Security Note
• https://systeam.com.br/cve/broken-access-control-en.txt · Vendor Advisory
• https://t.me/cibsecurity/34451 · Telegram Post