CVE-2021-42330

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-423315.4The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote CVE-2021-423324.3The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackCVE-2021-423338.8The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parCVE-2021-423348.8The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the pCVE-2021-423355.4Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privileCVE-2021-423364.3The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can acceCVE-2021-423374.3The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, theCVE-2021-423389.84MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication bCVE-2021-42347.5OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the clCVE-2021-423407.5The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduceCVE-2021-423417.5checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the enCVE-2021-423429.8An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts wit