{
  "id": "CVE-2021-42332",
  "sourceIdentifier": "twcert@cert.org.tw",
  "published": "2021-10-15T12:15:07.767",
  "lastModified": "2022-08-12T16:29:23.727",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "The \u201cList View\u201d function of ShinHer StudyOnline System is not under authority control. After logging in with user\u2019s privilege, remote attackers can access the content of other users\u2019 message boards by crafting URL parameters."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n de \"List View\" del sistema ShinHer StudyOnline System no est\u00e1 bajo el control de la autoridad. Despu\u00e9s de iniciar la sesi\u00f3n con privilegios de usuario, unos atacantes remotos pueden acceder al contenido de los tableros de mensajes de otros usuarios al dise\u00f1ar par\u00e1metros de la URL"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "twcert@cert.org.tw",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    },
    {
      "source": "twcert@cert.org.tw",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:xinheinformation:xinhe_teaching_platform_system:v2021:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E91C6E5-D003-4CF6-BE92-C7A9722FE749"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-5202-49681-1.html",
      "source": "twcert@cert.org.tw",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}