CVE-2021-42115

Critical

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an…

NCSC.ch·CWE-1004·Published 2021-11-30

CVSS

9.1

EPSS

0.01

KEV

Exploits

cve.orgen

303 chars

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID.

NVDen

303 chars

NVDes

371 chars

La falta del flag HTTPOnly en las aplicaciones web que operan en la plataforma TopEase® de Business-DNA Solutions GmbH, versiones anteriores a 7.1.27 incluyéndola, permite a un atacante remoto no autenticado escalar los privilegios de un usuario no autenticado a uno autenticado por medio del robo y la inyección del UID de la cookie estática e independiente de la sesión

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	6.4	10.0	4.9	AV:N/AC:L/Au:N/C:P/I:P/A:N
3.1	Primary	NVD	9.1	3.9	5.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
3.1	Primary	cve.org	8.1	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
3.1	Primary	cve.org	8.1	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
3.1	Secondary	NVD	8.1	2.8	5.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N