CVEvulnerability

CVE-2021-42337

4.3 MEDIUM Published 2021-11-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-11-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-285

Description

The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters.

Affected configurations

• aifu cashier accounting management system

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References