CVE-2021-27858

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote attacker to access at least the URL "/fpui/jsp/index.jsp" leading to unknown impact, presumably some violation of confidentiality. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA004.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Dec 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-278598.8A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60 CVE-2021-278608.8A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 al CVE-2021-278614.7Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN CVE-2021-278624.7Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi CVE-2021-278768.1An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authenticati CVE-2021-278779.8An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these.CVE-2021-278788.8An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authenticati CVE-2021-278845.1Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs bec CVE-2021-278858.8usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.CVE-2021-278869.8rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command CVE-2021-278875.4Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated applicatio CVE-2021-278886.1ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.