CVE-2021-34369

portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows remote attackers to obtain sensitive information via a modified contactSeqNumber value. NOTE: the vendor states "the information that is being queried is authorized for an authenticated user of that application, so we consider this not applicable.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/163116/Accela-Civic-Platform-21.1-Insecure-Direct-Object-Reference.html	Exploit Third Party Advisory VDB Entry
https://gist.github.com/0xx7/58943bb6e9ef77a09d3c7eb00dcafdc7	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:accela:civic_platform:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-06-09 12:15

Updated : 2024-05-17 01:58

NVD link : CVE-2021-34369

Mitre link : CVE-2021-34369

CVE.ORG link : CVE-2021-34369

JSON object : View

Products Affected

accela

civic_platform

CWE

NVD-CWE-noinfo

{"id": "CVE-2021-34369", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-06-09T12:15:08.033", "references": [{"url": "http://packetstormsecurity.com/files/163116/Accela-Civic-Platform-21.1-Insecure-Direct-Object-Reference.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/0xx7/58943bb6e9ef77a09d3c7eb00dcafdc7", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows remote attackers to obtain sensitive information via a modified contactSeqNumber value. NOTE: the vendor states \"the information that is being queried is authorized for an authenticated user of that application, so we consider this not applicable."}, {"lang": "es", "value": "** EN DISPUTA ** el archivo portlets/contact/ref/refContactDetail.do en Accela Civic Platform versiones hasta 20.1, permite a atacantes remotos obtener informaci\u00f3n confidencial por medio de un valor contactSeqNumber modificado. NOTA: el proveedor afirma que \"la informaci\u00f3n que se est\u00e1 consultando est\u00e1 autorizada para un usuario autentificado de esa aplicaci\u00f3n, por lo que consideramos que no es aplicable\"."}], "lastModified": "2024-05-17T01:58:14.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:accela:civic_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0985CF31-4972-4D56-9A04-8234E75B5737", "versionEndIncluding": "20.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}