What is CVE-2021-42337?

CVE-2021-42337 is a medium-severity vulnerability in Aifu Cashier Accounting Management System, classified under Improper Authorization. CVSS score: 4.3/10. Published 2021-11-16.

How severe is CVE-2021-42337?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2021-42337 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Aifu Cashier Accounting Management System

CVE-2021-42337

The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters.

EPSS: 0.009 (55.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Aifu Cashier_accounting_management_system
Aifu Information Technology Co. Cash — versions 0

Weakness classification (CWE)

CWE-285 — Improper Authorization

Public proof-of-concept exploits

aalexpereira/pipelines-tricks

References

twcert@cert.org.tw (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-42337?: CVE-2021-42337 is a medium-severity vulnerability in Aifu Cashier Accounting Management System, classified under Improper Authorization. CVSS score: 4.3/10. Published 2021-11-16.
How severe is CVE-2021-42337?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2021-42337 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.