CVE-2021-46075 Missing authorization in n/a
Staff users can access admin resources and perform CRUD operations due to missing authorization checks in the Vehicle Service Management System.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-46075?
CVE-2021-46075 is a high-severity missing authorization vulnerability in n/a, published on 6 Jan 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access the admin resources and perform CRUD Operations.
Weakness: CWE-862
Which versions are affected by CVE-2021-46075?
It affects 1 product.
Products include Vehicle Service Management System Project Vehicle Service Management System.
How do I fix CVE-2021-46075?
No fix has been published for CVE-2021-46075 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-46075 being exploited?
There is no known exploitation of CVE-2021-46075 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-3x3q-3ch4-c25f.