PT-2022-11213 · Syltek · Syltek

Published 2022-03-18 · Updated 2022-03-29 · CVE-2021-4031

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Syltek application versions prior to 10.22.00

Description The issue arises from the application's failure to correctly verify that a product ID has a valid payment associated with it. This could allow an attacker to forge a request, bypassing the payment system by marking items as paid without any verification.

Recommendations For versions prior to 10.22.00, update to version 10.22.00 or later to resolve the issue. As a temporary workaround, consider implementing additional validation checks for product IDs and their associated payments to minimize the risk of exploitation. Restrict access to the payment system to prevent unauthorized modifications until the update is applied.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2021-4031

Affected Products

Syltek

References · 4

• https://osv.dev/vulnerability/CVE-2021-4031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4031 · Security Note
• https://t.me/cibsecurity/39247 · Telegram Post
• https://incibe-cert.es/en/early-warning/security-advisories/syltek-insufficient-verification-data-authenticity · Note