CVE-2021-42791 Missing authorization in n/a

High 7.3 Published 28 Jan 2022 Updated 4 Aug 2024

Attackers can trigger push notifications for other users and steal login certificates if notifications are accepted, leading to account takeover.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-42791?

CVE-2021-42791 is a high-severity missing authorization vulnerability in n/a, published on 28 Jan 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified. If a user who receives the notification accepts it, then the user who triggered the notification can obtain the accepting user's login certificate.

Weakness: CWE-444

Which versions are affected by CVE-2021-42791?

It affects 1 product.

Products include Veridiumid Veridiumad.

How do I fix CVE-2021-42791?

No fix has been published for CVE-2021-42791 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-42791 being exploited?

There is no known exploitation of CVE-2021-42791 in the wild and no public exploit code.

Sources

Also known as GHSA-4x8v-5q76-ppwc.