CVE-2021-20874 Missing authorization in GroupSession Free edition, GroupSession byCloud, GroupSession ZION

High 7.5 Published 24 Dec 2021 Updated 3 Aug 2024

Remote unauthenticated attackers can access arbitrary files and obtain sensitive information due to incorrect permission assignments in GroupSession.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-20874?

CVE-2021-20874 is a high-severity missing authorization vulnerability in Japan Total System Co.,Ltd. GroupSession Free edition, GroupSession byCloud, GroupSession ZION, published on 24 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain sensitive information via unspecified vectors.

Weakness: CWE-732

Which versions are affected by CVE-2021-20874?

It affects 1 product.

Products include Groupsession Groupsession.

How do I fix CVE-2021-20874?

No fix has been published for CVE-2021-20874 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-20874 being exploited?

There is no known exploitation of CVE-2021-20874 in the wild and no public exploit code.

Sources

Also known as GHSA-4xfx-j5qc-9qj6.