CVE-2021-29012

Katalog CVE

CVSS 9.8 · Critical EPSS 3,2%

Kerentanan Improper Authentication pada dmasoftlab dma radius manager. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid (temporarily) during times when the admin is logged out. In other words, the cookie is functionally equivalent to a static password, and thus provides permanent access if stolen.

Rincian

Terbit di NVD

2 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/164154/DMA-Softlab-Radius-Manager-4.4.0-Session-Management-Cross-Site-Scr... exploit · advisory pihak ketiga · vdb entry
• https://github.com/1d8/publications/tree/main/cve-2021-29012 exploit · advisory pihak ketiga
• https://sourceforge.net/projects/radiusmanager/ product · advisory pihak ketiga