Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by changjia_property_management_system_project
CVE-2021-22858 (GCVE-0-2021-22858)
Vulnerability from cvelistv5 – Published: 2021-02-17 10:45 – Updated: 2024-09-17 01:35
VLAI
EPSS
VEX
Title
ChanGate EnterPrise Co., Ltd property management system - Broken Authentication
Summary
Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions.
Severity
8.8 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html | x_refsource_MISC |
| https://www.chtsecurity.com/news/fe1e30ef-4dac-48… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.560Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:34.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101012",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - Broken Authentication",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22858",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - Broken Authentication"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287 Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101012",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22858",
"datePublished": "2021-02-17T10:45:29.715Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:35:41.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22857 (GCVE-0-2021-22857)
Vulnerability from cvelistv5 – Published: 2021-02-17 10:45 – Updated: 2024-09-16 22:08
VLAI
EPSS
VEX
Title
ChanGate EnterPrise Co., Ltd property management system - Directory Traversal
Summary
The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily.
Severity
7.5 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html | x_refsource_MISC |
| https://www.chtsecurity.com/news/fe1e30ef-4dac-48… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.484Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:48.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101011",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - Directory Traversal",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22857",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - Directory Traversal"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22857",
"datePublished": "2021-02-17T10:45:29.023Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:08:22.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22856 (GCVE-0-2021-22856)
Vulnerability from cvelistv5 – Published: 2021-02-17 10:45 – Updated: 2024-09-17 01:51
VLAI
EPSS
VEX
Title
ChanGate EnterPrise Co., Ltd property management system - SQL Injection
Summary
The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege.
Severity
9.8 (Critical)
CWE
- CWE-89 - SQL Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html | x_refsource_MISC |
| https://www.chtsecurity.com/news/fe1e30ef-4dac-48… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.468Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:19.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101010",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22856",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101010",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22856",
"datePublished": "2021-02-17T10:45:28.427Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:51:39.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22857 (GCVE-0-2021-22857)
Vulnerability from nvd – Published: 2021-02-17 10:45 – Updated: 2024-09-16 22:08
VLAI
EPSS
VEX
Title
ChanGate EnterPrise Co., Ltd property management system - Directory Traversal
Summary
The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily.
Severity
7.5 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html | x_refsource_MISC |
| https://www.chtsecurity.com/news/fe1e30ef-4dac-48… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.484Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:48.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101011",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - Directory Traversal",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22857",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - Directory Traversal"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22857",
"datePublished": "2021-02-17T10:45:29.023Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:08:22.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22858 (GCVE-0-2021-22858)
Vulnerability from nvd – Published: 2021-02-17 10:45 – Updated: 2024-09-17 01:35
VLAI
EPSS
VEX
Title
ChanGate EnterPrise Co., Ltd property management system - Broken Authentication
Summary
Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions.
Severity
8.8 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html | x_refsource_MISC |
| https://www.chtsecurity.com/news/fe1e30ef-4dac-48… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.560Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:34.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101012",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - Broken Authentication",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22858",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - Broken Authentication"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287 Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101012",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22858",
"datePublished": "2021-02-17T10:45:29.715Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:35:41.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22856 (GCVE-0-2021-22856)
Vulnerability from nvd – Published: 2021-02-17 10:45 – Updated: 2024-09-17 01:51
VLAI
EPSS
VEX
Title
ChanGate EnterPrise Co., Ltd property management system - SQL Injection
Summary
The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege.
Severity
9.8 (Critical)
CWE
- CWE-89 - SQL Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html | x_refsource_MISC |
| https://www.chtsecurity.com/news/fe1e30ef-4dac-48… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.468Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:19.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101010",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22856",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101010",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22856",
"datePublished": "2021-02-17T10:45:28.427Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:51:39.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}