CVE-2021-43175

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-305 CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Dec 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-431768.8The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file exten CVE-2021-431775.3As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Passw CVE-2021-43188.8Object corruption in Blink in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit object corruption via a c CVE-2021-431807.5In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.CVE-2021-431816.1In JetBrains Hub before 2021.1.13690, stored XSS is possible.CVE-2021-431827.5In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.CVE-2021-431839.8In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.CVE-2021-431845.4In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.CVE-2021-431859.8JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.CVE-2021-431865.4JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.CVE-2021-431875.3In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information.CVE-2021-431887.3In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete.