CVE-2021-46086

xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnerability in the functional method of submitting examination papers. An attacker can use burpuite to modify parameters in the packet to destroy real data.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/mindskip/xzs-mysql/issues/327	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mindskip:xzs-mysql:t3.4.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-01-25 16:15

Updated : 2022-01-31 20:04

NVD link : CVE-2021-46086

Mitre link : CVE-2021-46086

CVE.ORG link : CVE-2021-46086

JSON object : View

Products Affected

mindskip

xzs-mysql

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2021-46086", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-01-25T16:15:08.967", "references": [{"url": "https://github.com/mindskip/xzs-mysql/issues/327", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnerability in the functional method of submitting examination papers. An attacker can use burpuite to modify parameters in the packet to destroy real data."}, {"lang": "es", "value": "xzs-mysql versiones posteriores a t3.4.0 incluy\u00e9ndola, es vulnerable a Permisos Inseguros. El front-end de este sistema de c\u00f3digo abierto es un sistema de ex\u00e1menes en l\u00ednea. Se presenta una vulnerabilidad no segura en el m\u00e9todo funcional de presentaci\u00f3n de ex\u00e1menes. Un atacante puede usar burpuite para modificar los par\u00e1metros del paquete para destruir los datos reales"}], "lastModified": "2022-01-31T20:04:36.447", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mindskip:xzs-mysql:t3.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C99B3E07-2A31-4AE7-BB5D-07CA2BF7299C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}