nvd-json-data-feeds/CVE-2021/CVE-2021-387xx/CVE-2021-38705.json

{
  "id": "CVE-2021-38705",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2021-09-07T20:15:08.040",
  "lastModified": "2021-09-10T19:27:50.417",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "ClinicCases 7.3.3 is affected by Cross-Site Request Forgery (CSRF). A successful attack would consist of an authenticated user following a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user. This can be exploited to create a secondary administrator account for the attacker."
    },
    {
      "lang": "es",
      "value": "ClinicCases versi\u00f3n 7.3.3, est\u00e1 afectado por una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF). Un ataque con \u00e9xito consistir\u00eda en que un usuario autenticado siguiera un enlace malicioso, resultando en una realizaci\u00f3n de acciones arbitrarias con el nivel de privilegio del usuario objetivo. Esto puede ser explotado para crear una cuenta de administrador secundaria para el atacante"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:cliniccases:cliniccases:7.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B592D4CE-7412-48C9-9B52-08A0EF43FFFD"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/judsonmitchell/ClinicCases/releases",
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/sudonoodle/CVE-2021-38705",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}