CVE-2021-3833 Integria IMS incorrect authorization
Attackers can bypass authentication in Integria IMS by exploiting loose comparison of MD5 hashes, allowing unauthorized access to user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3833?
CVE-2021-3833 is a critical authentication bypass vulnerability in Ártica Integria IMS, published on 7 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords.
Weakness: CWE-697
Which versions are affected by CVE-2021-3833?
It affects 1 product.
Products include Artica Integria Ims.
How do I fix CVE-2021-3833?
No fix has been published for CVE-2021-3833 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-3833 being exploited?
There is no known exploitation of CVE-2021-3833 in the wild and no public exploit code.
Other vulnerabilities in Ártica Integria IMS
Sources
Also known as GHSA-5pf8-m5c6-qc44.