CVEvulnerability

CVE-2021-22860

9.8 CRITICAL Published 2021-03-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-03-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287

Description

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary commends.

Affected configurations

• eic e-document system 2.9 • eic e-document system 3.0.2

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References