CVE-2021-32006 GateManager information leak for LinkManager Users
Logged-in LinkManager users can access stored SiteManager backup files due to missing authorization checks in the web portal.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32006?
CVE-2021-32006 is a medium-severity missing authorization vulnerability in Secomea GateManager, published on 7 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web portal of Secomea GateManager allows logged in LinkManager user to access stored SiteManager backup files.
Which versions are affected by CVE-2021-32006?
It affects 1 product.
Products include Secomea Gatemanager.
How do I fix CVE-2021-32006?
No fix has been published for CVE-2021-32006 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-32006 being exploited?
There is no known exploitation of CVE-2021-32006 in the wild and no public exploit code.
Other vulnerabilities in Secomea GateManager
- CVE-2021-32008 Logged-in Administrator may get unrestricted file system access
- CVE-2022-38123 Insufficient validation of plugin files
- CVE-2022-4308 Clear-text passwords in configuration files
- CVE-2022-2752 Potential vulnerabilities in GM login process
- CVE-2021-32009 Missing XSS guards on firmware page
Sources
Also known as GHSA-xf56-6gfr-p968.