CVE-2021-38289

Katalog CVE

CVSS 8.8 · High EPSS 1,6%

Kerentanan Incorrect Permission Assignment for Critical Resource pada novastar novaicare. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view corporate information and SMTP server details, delete users, view roles, and other unspecified impacts. NOTE: As of April 2026, the vendor has officially decommissioned the affected legacy endpoints and associated services. The vulnerability is mitigated as the functional logic is no longer operational and the URLs have been removed from production.

Rincian

Terbit di NVD

12 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/viperbluff/Novastar-VNNOX-iCare-Privilege-Escalation exploit · advisory pihak ketiga
• https://twitter.com/viperbluff/status/1439941380244230150?s=20&t=iPSn8eNxaxUKis5OKSQJRQ exploit · advisory pihak ketiga
• https://security.novaicare.com/advisory-cve-2021-38289.html