CVE-2021-27453 Mesa Labs AmegaView authentication bypass

What is CVE-2021-27453?

CVE-2021-27453 is a high-severity authentication bypass vulnerability in Mesa Labs AmegaView, published on 21 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Mesa Labs AmegaView Versions 3.0 uses default cookies that could be set to bypass authentication to the web application, which may allow an attacker to gain access.

Weakness: CWE-288

Which versions are affected by CVE-2021-27453?

It affects 1 product.

Products include Mesalabs Amegaview.

How do I fix CVE-2021-27453?

No fix has been published for CVE-2021-27453 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-27453 being exploited?

There is no known exploitation of CVE-2021-27453 in the wild and no public exploit code.

Other vulnerabilities in Mesa Labs AmegaView

• CVE-2021-27447 Mesa Labs AmegaView command injection Critical 10.0
• CVE-2021-27449 Mesa Labs AmegaView Command Injection Critical 9.9
• CVE-2021-27445 Mesa Labs AmegaView Improper Privilege Management High 7.8
• CVE-2021-27451 Mesa Labs AmegaView improper authentication High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6f9w-r8mj-4h2w.