CVE-2021-32077 Information disclosure in n/a
An anonymous attacker can brute-force a search field to discover healthcare providers' Social Security Numbers and other PII.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32077?
CVE-2021-32077 is a high-severity vulnerability in n/a, published on 6 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number (SSN) values via a brute-force attack on a (sometimes hidden) search field, because the last four SSN digits are part of the supported combination of search selectors. This discloses doctors' and nurses' social security numbers and PII.
Which versions are affected by CVE-2021-32077?
It affects 1 product.
Products include Veritystream Msow Solutions.
How do I fix CVE-2021-32077?
No fix has been published for CVE-2021-32077 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-32077 being exploited?
There is no known exploitation of CVE-2021-32077 in the wild and no public exploit code.
Sources
Also known as GHSA-8m4r-xfjr-cfgm.