CVE-2021-27228

Katalog CVE

CVSS 9.8 · Critical EPSS 1,8%

Kerentanan Use of Hard-coded Credentials pada shinobi pro. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names (such as constructor or hasOwnProperty) to convince the System that the supplied API Key exists in the underlying JS object, and consequently achieve complete access to User/Admin/Super API functions, as demonstrated by a /super/constructor/accounts/list URI.

Rincian

Terbit di NVD

22 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.com/Shinobi-Systems/Shinobi/-/merge_requests/286 patch · advisory pihak ketiga
• https://gitlab.com/Shinobi-Systems/Shinobi/-/tags patch · advisory pihak ketiga
• https://shinobi.video/ product