CVE-2021-42791

Katalog CVE

CVSS 7.3 · High EPSS 0,63%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada veridiumid veridiumad. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified. If a user who receives the notification accepts it, then the user who triggered the notification can obtain the accepting user's login certificate.

Rincian

Terbit di NVD

28 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.veridiumid.com/press/veridium-eliminates-passwords-with-veridiumad-for-enterprises-using-microsoft... product · advisory vendor
• https://www.compass-security.com/en/research/advisories advisory pihak ketiga
• https://www.compass-security.com/fileadmin/Research/Advisories/2022_03_CSNC-2021-017_VeridiumId_Broken_Access_... advisory pihak ketiga