FKIE_CVE-2021-27215

Vulnerability from fkie_nvd - Published: 2021-03-03 16:15 - Updated: 2024-11-21 05:57
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces (Admin, Userweb, Sidechannel) can use different methods to perform the authentication of a user. A specific authentication method during login does not check the provided data (when a certain manipulation occurs) and returns OK for any authentication request. This allows an attacker to login to the admin panel as a user of his choice, e.g., the root user (with highest privileges) or even a non-existing user.
References
cve@mitre.orghttps://kunde.genua.de/en/overview/genugate.htmlPatch, Vendor Advisory
cve@mitre.orghttps://sec-consult.com/vulnerability-lab/advisory/authentication-bypass-genua-genugate/Exploit, Third Party Advisory
cve@mitre.orghttps://www.genua.de/en/it-security-solutions/high-resistance-firewall-genugateProduct
af854a3a-2127-422b-91ae-364da2661108https://kunde.genua.de/en/overview/genugate.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://sec-consult.com/vulnerability-lab/advisory/authentication-bypass-genua-genugate/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.genua.de/en/it-security-solutions/high-resistance-firewall-genugateProduct
Impacted products
Vendor Product Version
genua genuagate *
genua genuagate *
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.0
genua genuagate 9.6.0
genua genuagate 9.6.0
genua genuagate 9.6.0
genua genuagate 9.6.0
genua genuagate 9.6.0
genua genuagate 9.6.0
genua genuagate 9.6.0
genua genuagate 10.1
genua genuagate 10.1
genua genuagate 10.1
genua genuagate 10.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:genua:genuagate:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FADEEBC-C501-409B-854B-0CC58FE420A3",
              "versionEndIncluding": "9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "32D923C1-C076-4B96-BA7E-E30680E8469C",
              "versionEndIncluding": "10.1",
              "versionStartIncluding": "10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "4895F129-32DB-4BD9-A38E-F2913B49EACA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p1:*:*:*:*:*:*",
              "matchCriteriaId": "F8ECED92-CBF4-4F5C-85F9-2350489959FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p10:*:*:*:*:*:*",
              "matchCriteriaId": "5CFCB610-61C8-4DB3-AFF9-FA0232311524",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p11:*:*:*:*:*:*",
              "matchCriteriaId": "9DE8EEF8-6ACB-4A45-A387-A2C2CB8F01DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p12:*:*:*:*:*:*",
              "matchCriteriaId": "21F545C1-584D-4685-8844-BEC0619E2CC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p13:*:*:*:*:*:*",
              "matchCriteriaId": "F003ECB8-2AA1-48F0-8154-EC3BC6302624",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p14:*:*:*:*:*:*",
              "matchCriteriaId": "D7137C47-E0FE-4122-861C-5B8867C4B7BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p15:*:*:*:*:*:*",
              "matchCriteriaId": "F67F0956-12D2-4F33-ACF5-46A66E97B127",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p16:*:*:*:*:*:*",
              "matchCriteriaId": "DC4F2F77-A34D-457D-B9CE-CD319ADBB0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p17:*:*:*:*:*:*",
              "matchCriteriaId": "64E98FD2-C95B-46C6-ABA7-D431C215CEE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p18:*:*:*:*:*:*",
              "matchCriteriaId": "553390E0-4076-49A2-A8D9-763700FC86E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p2:*:*:*:*:*:*",
              "matchCriteriaId": "F1CB642E-33C7-43CE-8924-02F58AC72202",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p3:*:*:*:*:*:*",
              "matchCriteriaId": "DDFE58DE-FBA0-4A34-B564-6B79F3991212",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p4:*:*:*:*:*:*",
              "matchCriteriaId": "55DF78F2-1F8A-406B-B435-238D6B7FB6C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p5:*:*:*:*:*:*",
              "matchCriteriaId": "24488A8B-9C74-4DD9-A8D4-D24B7F6334AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p6:*:*:*:*:*:*",
              "matchCriteriaId": "D538E9D4-479E-4A83-9CB6-2572237AD246",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p7:*:*:*:*:*:*",
              "matchCriteriaId": "76B327F2-4220-4336-A002-E5902A409D18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p8:*:*:*:*:*:*",
              "matchCriteriaId": "73D9F4A7-650A-4A41-86DB-637C179A5627",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.0:p9:*:*:*:*:*:*",
              "matchCriteriaId": "983A322D-6D93-457C-BB5A-404DE6BF64EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.6.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "12CD70FD-C653-46C5-8CDD-5CE31780A973",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.6.0:p1:*:*:*:*:*:*",
              "matchCriteriaId": "52E3918B-01B4-45C0-BBC3-233D02E7BB0D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.6.0:p2:*:*:*:*:*:*",
              "matchCriteriaId": "36F405B7-D3B1-47DB-BE1F-5116D41324F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.6.0:p3:*:*:*:*:*:*",
              "matchCriteriaId": "2F2B4650-C51B-4BA5-9A31-0DCC595419C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.6.0:p4:*:*:*:*:*:*",
              "matchCriteriaId": "7F6F7E68-43F4-442D-8516-A84AF3A7F736",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.6.0:p5:*:*:*:*:*:*",
              "matchCriteriaId": "7AD71A26-EFCB-449A-89F0-947AA291EAD7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:9.6.0:p6:*:*:*:*:*:*",
              "matchCriteriaId": "8616E470-5887-4A2B-B11D-19EA460D5AC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:10.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "CAB744C9-4562-4A77-98AD-99A0B24DABD2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:10.1:p1:*:*:*:*:*:*",
              "matchCriteriaId": "002A422D-959E-491A-BB22-109177256903",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:10.1:p2:*:*:*:*:*:*",
              "matchCriteriaId": "29B8F70C-C496-45C0-ABCD-85E7F1FA914C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:genua:genuagate:10.1:p3:*:*:*:*:*:*",
              "matchCriteriaId": "3051E329-7A2F-4063-A162-B2646257D365",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces (Admin, Userweb, Sidechannel) can use different methods to perform the authentication of a user. A specific authentication method during login does not check the provided data (when a certain manipulation occurs) and returns OK for any authentication request. This allows an attacker to login to the admin panel as a user of his choice, e.g., the root user (with highest privileges) or even a non-existing user."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 un problema en genua genugate versiones anteriores a 9.0 Z p19, versiones 9.1.x hasta 9.6.x anteriores a 9.6 p7 y versiones 10.x anteriores a 10.1 p4.\u0026#xa0;Las interfaces web (Admin, Userweb, Sidechannel) pueden usar diferentes m\u00e9todos para lleva a cabo la autenticaci\u00f3n de un usuario.\u0026#xa0;Un m\u00e9todo de autenticaci\u00f3n espec\u00edfico durante el inicio de sesi\u00f3n no comprueba los datos proporcionados (cuando ocurre una determinada manipulaci\u00f3n) y devuelve OK para cualquier petici\u00f3n de autenticaci\u00f3n.\u0026#xa0;Esto permite a un atacante iniciar sesi\u00f3n en el panel de administraci\u00f3n como un usuario de su elecci\u00f3n, por ejemplo, el usuario root (con los privilegios m\u00e1s altos) o inclusive un usuario no existente"
    }
  ],
  "id": "CVE-2021-27215",
  "lastModified": "2024-11-21T05:57:36.757",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-03-03T16:15:13.260",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://kunde.genua.de/en/overview/genugate.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://sec-consult.com/vulnerability-lab/advisory/authentication-bypass-genua-genugate/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://www.genua.de/en/it-security-solutions/high-resistance-firewall-genugate"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://kunde.genua.de/en/overview/genugate.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://sec-consult.com/vulnerability-lab/advisory/authentication-bypass-genua-genugate/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://www.genua.de/en/it-security-solutions/high-resistance-firewall-genugate"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.