PT-2025-44459 · Seeyon · Seeyon Zhiyuan Oa

Published 2025-10-30 · Updated 2025-11-28 · CVE-2021-4461

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1

Description The software does not properly decode and parse the enc parameter in the thirdpartyController.do endpoint. The decoded map values can influence session attributes without sufficient authentication or authorization checks, allowing attackers to assign a session to arbitrary user IDs. This issue has been observed being exploited in the wild. The vulnerable endpoint is /thirdpartyController.do. The enc parameter is vulnerable.

Recommendations Versions prior to 7.0 SP1 should be used.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-4461

Affected Products

Seeyon Zhiyuan Oa

References · 9

• 🔥 https://github.com/projectdiscovery/nuclei-templates/blob/1ca6b8e6fe225cbd46dcb893dcaee01447afa8c0/http/misconfiguration/seeyon-unauth.yaml#L20 · Exploit
• 🔥 https://github.com/chaitin/xray/blob/f90cf321bc4d294bbf6625a9c4853f3bfdf0a384/pocs/seeyon-oa-cookie-leak.yml · Exploit
• 🔥 https://mp.weixin.qq.com/s/0AqdfTrZUVrwTMbKEKresg · Exploit
• https://osv.dev/vulnerability/CVE-2021-4461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4461 · Security Note
• https://t.me/cveNotify/144288 · Telegram Post
• https://vulncheck.com/advisories/seeyon-zhiyuan-oa-web-application-system-authentication-bypass · Note
• https://twitter.com/CVEnew/status/1984012732669002106 · Twitter Post
• https://twitter.com/0dayPublishing/status/1984008542605475928 · Twitter Post