cnvd - cnvd-2022-07493

CNVD-2022-07493

Vulnerability from cnvd - Published: 2022-01-28

Title

TCMAN GIM开放重定向漏洞

Description

TCMAN Gim是专为在移动设备上使用而设计的设施管理软件。 TCMAN GIM存在开放重定向漏洞，攻击者可利用该漏洞将用户重定至攻击者控制的页面并获取信息。

Severity

中

Patch Name

TCMAN GIM开放重定向漏洞的补丁

Patch Description

TCMAN Gim是专为在移动设备上使用而设计的设施管理软件。 TCMAN GIM存在开放重定向漏洞，攻击者可利用该漏洞将用户重定至攻击者控制的页面并获取信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://tcman.com/gim-v11

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-40852

Impacted products

Name
TCMAN GIM

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-40852",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-40852"
    }
  },
  "description": "TCMAN Gim\u662f\u4e13\u4e3a\u5728\u79fb\u52a8\u8bbe\u5907\u4e0a\u4f7f\u7528\u800c\u8bbe\u8ba1\u7684\u8bbe\u65bd\u7ba1\u7406\u8f6f\u4ef6\u3002\n\nTCMAN GIM\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u7528\u6237\u91cd\u5b9a\u81f3\u653b\u51fb\u8005\u63a7\u5236\u7684\u9875\u9762\u5e76\u83b7\u53d6\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://tcman.com/gim-v11",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-07493",
  "openTime": "2022-01-28",
  "patchDescription": "TCMAN Gim\u662f\u4e13\u4e3a\u5728\u79fb\u52a8\u8bbe\u5907\u4e0a\u4f7f\u7528\u800c\u8bbe\u8ba1\u7684\u8bbe\u65bd\u7ba1\u7406\u8f6f\u4ef6\u3002\r\n\r\nTCMAN GIM\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u7528\u6237\u91cd\u5b9a\u81f3\u653b\u51fb\u8005\u63a7\u5236\u7684\u9875\u9762\u5e76\u83b7\u53d6\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "TCMAN GIM\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "TCMAN GIM"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-40852",
  "serverity": "\u4e2d",
  "submitTime": "2021-12-20",
  "title": "TCMAN GIM\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}

CVE-2021-40852 (GCVE-0-2021-40852)

Vulnerability from cvelistv5 – Published: 2021-12-17 16:10 – Updated: 2024-09-16 18:56

Summary

TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote attacker to obtain information.

Severity ?

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

INCIBE

References

URL

Tags

https://www.incibe-cert.es/en/early-warning/secur…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	TCMAN	GIM	Affected: 8.0 Affected: 11.0

Credits

Victor Fidalgo Villar

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:51:07.466Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-open-redirect-vulnerability"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GIM",
          "vendor": "TCMAN",
          "versions": [
            {
              "status": "affected",
              "version": "8.0"
            },
            {
              "status": "affected",
              "version": "11.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Victor Fidalgo Villar"
        }
      ],
      "datePublic": "2021-12-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote attacker to obtain information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-17T16:10:32",
        "orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
        "shortName": "INCIBE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-open-redirect-vulnerability"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This vulnerability has been solved by TCMAN in GIM v8.0.1 Release 31734"
        }
      ],
      "source": {
        "advisory": "INCIBE-2021-0510",
        "discovery": "EXTERNAL"
      },
      "title": "TCMAN GIM open redirect vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-coordination@incibe.es",
          "DATE_PUBLIC": "2021-12-17T09:00:00.000Z",
          "ID": "CVE-2021-40852",
          "STATE": "PUBLIC",
          "TITLE": "TCMAN GIM open redirect vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GIM",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "8.0",
                            "version_value": "8.0"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "11.0",
                            "version_value": "11.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TCMAN"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Victor Fidalgo Villar"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote attacker to obtain information."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-open-redirect-vulnerability",
              "refsource": "CONFIRM",
              "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-open-redirect-vulnerability"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "This vulnerability has been solved by TCMAN in GIM v8.0.1 Release 31734"
          }
        ],
        "source": {
          "advisory": "INCIBE-2021-0510",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
    "assignerShortName": "INCIBE",
    "cveId": "CVE-2021-40852",
    "datePublished": "2021-12-17T16:10:32.835933Z",
    "dateReserved": "2021-09-10T00:00:00",
    "dateUpdated": "2024-09-16T18:56:14.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2022-07493

CVE-2021-40852 (GCVE-0-2021-40852)

Tags

Sightings

Nomenclature