PT-2021-6946 · Hitachi · Hitachi Content Platform Anywhere

Published 2021-09-29 · Updated 2021-10-07 · CVE-2021-41573

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Content Platform Anywhere (HCP-AW) versions 4.4.5 and later

Description The issue is related to insufficient protection of registration data, which may allow a remote attacker to gain unauthorized access to protected information. If an authenticated user creates a link to a file or folder while the system is running version 4.3.x or earlier, shares the link, and then deletes the file or folder without deleting the link before it expires, a malicious user with the link could browse and download all files of the authenticated user who created the link after the system has been upgraded to version 4.4.5 or 4.5.0.

Recommendations For Hitachi Content Platform Anywhere (HCP-AW) versions 4.4.5 and later, consider deleting links to files or folders when they are deleted to prevent information disclosure. As a temporary workaround, restrict access to shared links to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

BDU:2022-02717

CVE-2021-41573

Affected Products

Hitachi Content Platform Anywhere

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-41573 · Security Note
• https://hitachi.com/hirt/security/index.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41573 · Vendor Advisory
• https://hitachi.com/hirt/hitachi-sec/2021/602.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02717 · Security Note
• https://t.me/cvenotify/21645 · Telegram Post
• https://t.me/cibsecurity/29676 · Telegram Post