Search criteria
6 vulnerabilities found for property management system by ChanGate EnterPrise Co., Ltd
CVE-2021-22858 (GCVE-0-2021-22858)
Vulnerability from nvd – Published: 2021-02-17 10:45 – Updated: 2024-09-17 01:35
VLAI?
Title
ChanGate EnterPrise Co., Ltd property management system - Broken Authentication
Summary
Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions.
Severity ?
8.8 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public ?
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.560Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:34.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101012",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - Broken Authentication",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22858",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - Broken Authentication"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287 Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101012",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22858",
"datePublished": "2021-02-17T10:45:29.715Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:35:41.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22857 (GCVE-0-2021-22857)
Vulnerability from nvd – Published: 2021-02-17 10:45 – Updated: 2024-09-16 22:08
VLAI?
Title
ChanGate EnterPrise Co., Ltd property management system - Directory Traversal
Summary
The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily.
Severity ?
7.5 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public ?
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.484Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:48.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101011",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - Directory Traversal",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22857",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - Directory Traversal"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22857",
"datePublished": "2021-02-17T10:45:29.023Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:08:22.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22856 (GCVE-0-2021-22856)
Vulnerability from nvd – Published: 2021-02-17 10:45 – Updated: 2024-09-17 01:51
VLAI?
Title
ChanGate EnterPrise Co., Ltd property management system - SQL Injection
Summary
The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege.
Severity ?
9.8 (Critical)
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public ?
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.468Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:19.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101010",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22856",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101010",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22856",
"datePublished": "2021-02-17T10:45:28.427Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:51:39.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22858 (GCVE-0-2021-22858)
Vulnerability from cvelistv5 – Published: 2021-02-17 10:45 – Updated: 2024-09-17 01:35
VLAI?
Title
ChanGate EnterPrise Co., Ltd property management system - Broken Authentication
Summary
Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions.
Severity ?
8.8 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public ?
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.560Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:34.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101012",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - Broken Authentication",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22858",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - Broken Authentication"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287 Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4396-e6d44-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101012",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22858",
"datePublished": "2021-02-17T10:45:29.715Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:35:41.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22857 (GCVE-0-2021-22857)
Vulnerability from cvelistv5 – Published: 2021-02-17 10:45 – Updated: 2024-09-16 22:08
VLAI?
Title
ChanGate EnterPrise Co., Ltd property management system - Directory Traversal
Summary
The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily.
Severity ?
7.5 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public ?
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.484Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:48.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101011",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - Directory Traversal",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22857",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - Directory Traversal"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101011",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22857",
"datePublished": "2021-02-17T10:45:29.023Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:08:22.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22856 (GCVE-0-2021-22856)
Vulnerability from cvelistv5 – Published: 2021-02-17 10:45 – Updated: 2024-09-17 01:51
VLAI?
Title
ChanGate EnterPrise Co., Ltd property management system - SQL Injection
Summary
The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege.
Severity ?
9.8 (Critical)
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ChanGate EnterPrise Co., Ltd | property management system |
Affected:
0 , ≤ 1.00
(custom)
|
Date Public ?
2021-02-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:51:07.468Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "property management system",
"vendor": "ChanGate EnterPrise Co., Ltd",
"versions": [
{
"lessThanOrEqual": "1.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-19T18:37:19.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
],
"solutions": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101010",
"discovery": "EXTERNAL"
},
"title": "ChanGate EnterPrise Co., Ltd property management system - SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-02-17T10:32:00.000Z",
"ID": "CVE-2021-22856",
"STATE": "PUBLIC",
"TITLE": "ChanGate EnterPrise Co., Ltd property management system - SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "property management system",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "0",
"version_value": "1.00"
}
]
}
}
]
},
"vendor_name": "ChanGate EnterPrise Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.html"
},
{
"name": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422",
"refsource": "CONFIRM",
"url": "https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update CGE property management system to the latest version."
}
],
"source": {
"advisory": "TVN-202101010",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-22856",
"datePublished": "2021-02-17T10:45:28.427Z",
"dateReserved": "2021-01-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:51:39.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}