CVE-2021-42337

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
AIFU Information Technology Co.	CASH	—

References

https://www.twcert.org.tw/tw/cp-132-5296-cbf80-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-5296-cbf80-1.htmlThird Party Advisory

Timeline

Published: Nov 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-423389.84MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication b CVE-2021-42347.5OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the cl CVE-2021-423407.5The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduce CVE-2021-423417.5checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the en CVE-2021-423429.8An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts wit CVE-2021-423439.8An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distribu CVE-2021-42355.5Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing use CVE-2021-423576.1When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A CVE-2021-423588.8The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-for CVE-2021-423599.1WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was a CVE-2021-42369.8Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData po CVE-2021-423605.4On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which include