Exacqvision Web Service
CVE-2021-27656
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system.
AnalysisAI
A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Technical ContextAI
This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. A vulnerability in exacqVision Web Service 20.12.2.0 and prior could allow an unauthenticated attacker to view system-level information about the exacqVision Web Service and the operating system. Affected products include: Johnsoncontrols Exacqvision Web Service.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.
More in Exacqvision Web Service
View allA vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems runni
Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVisi
Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF). Rated
Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains.
Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS). Rated high seve
exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input befo
Under certain circumstances the exacqVision Web Service can expose authentication token details within communications. R
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today