What is CVE-2021-36722?

CVE-2021-36722 is a high-severity vulnerability in Emuse Eservices / Envoice, classified under SQL Injection. CVSS score: 7.1/10. Published 2021-12-29.

How severe is CVE-2021-36722?

High severity. CVSS v3 base score is 7.1 out of 10.

SQL Injection in Emuse Eservices / Envoice

CVE-2021-36722

Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host.

Vulnerability class: SQL Injection

EPSS: 0.013 (68.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N.

Affected products

Emuse Eservices / Envoice — versions Production
Emuse_-_eservices_\/_envoice_project Emuse_-_eservices_\/_envoice

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cna@cyber.gov.il (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2021-36722?: CVE-2021-36722 is a high-severity vulnerability in Emuse Eservices / Envoice, classified under SQL Injection. CVSS score: 7.1/10. Published 2021-12-29.
How severe is CVE-2021-36722?: High severity. CVSS v3 base score is 7.1 out of 10.