CVE-2021-45900

Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie is assigned so that they can be uniquely identified. Certain APIs can be successfully executed without proper authentication. This can let an attacker impersonate as victim and make state changing requests on their behalf.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://vivoh.com/blog/finra-remediation/	Exploit Vendor Advisory
https://vivoh.com/wp-content/uploads/2021/11/Vivoh-Webinar-Manager-for-Zoom-Installation-and-Administration-Guide.pdf	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:vivoh:webinar_manager:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-03-30 22:15

Updated : 2022-04-06 00:14

NVD link : CVE-2021-45900

Mitre link : CVE-2021-45900

CVE.ORG link : CVE-2021-45900

JSON object : View

Products Affected

vivoh

webinar_manager

CWE

CWE-287

Improper Authentication

{"id": "CVE-2021-45900", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-03-30T22:15:08.447", "references": [{"url": "https://vivoh.com/blog/finra-remediation/", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://vivoh.com/wp-content/uploads/2021/11/Vivoh-Webinar-Manager-for-Zoom-Installation-and-Administration-Guide.pdf", "tags": ["Broken Link"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie is assigned so that they can be uniquely identified. Certain APIs can be successfully executed without proper authentication. This can let an attacker impersonate as victim and make state changing requests on their behalf."}, {"lang": "es", "value": "Vivoh Webinar Manager versiones anteriores a 3.6.3.0, presenta una autenticaci\u00f3n inapropiada de la API. Cuando un usuario es registrado en el portlet web de configuraci\u00f3n de la administraci\u00f3n, le es asignada una cookie VIVOH_AUTH para que pueda ser identificado de forma \u00fanica. Algunas APIs pueden ser ejecutadas con \u00e9xito sin una autenticaci\u00f3n apropiada. Esto puede permitir a un atacante hacerse pasar por la v\u00edctima y realizar peticiones de cambio de estado en su nombre"}], "lastModified": "2022-04-06T00:14:01.320", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vivoh:webinar_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70919639-2855-4666-9DAF-0A083CFE01A6", "versionEndExcluding": "3.6.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}