CVE-2021-43974

Katalog CVE

CVSS 5.3 · Medium EPSS 1,4%

Kerentanan Missing Authentication for Critical Function pada sysaid itil. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous user registration only hides the client-side registration form. An attacker can still post registration data to create new accounts without prior authentication.

Rincian

Terbit di NVD

11 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.sysaid.com/it-service-management-software/incident-management advisory vendor
• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md broken link · advisory pihak ketiga
• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md exploit · advisory pihak ketiga