Skip to main content

Ehrd CVE-2021-43359

HIGH
Incorrect Permission Assignment for Critical Resource (CWE-732)
2021-12-01 twcert@cert.org.tw
RCE Privilege Escalation Ehrd
8.8
CVSS 3.1 · Vendor: cert
Share

Severity by source

Vendor (cert) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 01, 2021 - 02:15 cve.org
HIGH 8.8

DescriptionCVE.org

Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to execute arbitrary code and control the system or interrupt services.

AnalysisAI

Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to execute arbitrary code and control the system or interrupt services. Affected products include: Sun Ehrd.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and restrict file/resource permissions, apply principle of least privilege.

More in Ehrd

View all
CVE-2021-43360 HIGH
8.8 Dec 01

Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restrictio
CVE-2021-43358 HIGH
7.5 Dec 01

Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path trav
CVE-2020-10508 HIGH
7.5 Mar 27

Sunnet eHRD, a human training and development management system, improperly stores system files. Rated high severity (CV
CVE-2020-10510 MEDIUM
6.5 Mar 27

Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. Rate
CVE-2020-10509 MEDIUM
6.1 Mar 27

Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), a

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2021-43359 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy