PT-2022-10711 · Unknown · Novastar-Vnnox-Icare Novaicare

Viperbluff · Published 2022-07-12 · Updated 2022-07-15 · CVE-2021-38289

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Novastar-VNNOX-iCare Novaicare version 7.16.0

Description The issue allows attackers to gain privilege escalation, enabling them to view corporate information and SMTP server details, delete users, view roles, and potentially cause other unspecified impacts.

Recommendations For Novastar-VNNOX-iCare Novaicare version 7.16.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-38289

Affected Products

Novastar-Vnnox-Icare Novaicare

References · 5

• 🔥 https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-Escalation · Exploit
• 🔥 https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5OKSQJRQ · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38289 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38289 · Vendor Advisory
• https://security.novaicare.com/advisory-cve-2021-38289.html · Note