PT-2022-12242 · Delta Rm · Delta Rm

Renato Cruz · Published 2022-01-18 · Updated 2023-08-08 · CVE-2021-44838

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Delta RM version 1.2

Description An issue was discovered that allows users to access risks of other companies. This is achieved by using the "/risque/risque/ajax-details" endpoint with a POST request, specifying the risk to access with the id parameter.

Recommendations For Delta RM version 1.2, as a temporary workaround, consider restricting access to the "/risque/risque/ajax-details" endpoint until a patch is available. Avoid using the id parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-44838

Affected Products

Delta Rm

References · 5

• 🔥 https://gist.github.com/rntcruz23/6575c0ef45c30687c538361910bb8ab3 · Exploit
• https://osv.dev/vulnerability/CVE-2021-44838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44838 · Security Note
• https://deltarm.com · Vendor Advisory
• https://t.me/cibsecurity/35742 · Telegram Post