CVE-2021-42791

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified. If a user who receives the notification accepts it, then the user who triggered the notification can obtain the accepting user's login certificate.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-427945.3An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a CVE-2021-427969.8An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticateCVE-2021-427977.5Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal tCVE-2021-42806.5A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_sCVE-2021-428086.7Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges.CVE-2021-428097.8Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbCVE-2021-42819.8A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the CVE-2021-428107.8A flaw in the previous versions of the product may allow an authenticated attacker the ability to execute code as a privileged user on a sysCVE-2021-428116.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SafeNet KeySecure allows an authenticated usCVE-2021-42826.1A vulnerability was found in FreePBX voicemail. It has been declared as problematic. Affected by this vulnerability is an unknown functionalCVE-2021-42835.4A vulnerability was found in FreeBPX voicemail. It has been rated as problematic. Affected by this issue is some unknown functionality of thCVE-2021-428338.8A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker