CVE-2021-45900

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie is assigned so that they can be uniquely identified. Certain APIs can be successfully executed without proper authentication. This can let an attacker impersonate as victim and make state changing requests on their behalf.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://vivoh.com/blog/finra-remediation/Exploit, Vendor Advisory
https://vivoh.com/wp-content/uploads/2021/11/Vivoh-Webinar-Manager-for-Zoom-Installation-and-Administration-Guide.pdfBroken Link
https://vivoh.com/blog/finra-remediation/Exploit, Vendor Advisory
https://vivoh.com/wp-content/uploads/2021/11/Vivoh-Webinar-Manager-for-Zoom-Installation-and-Administration-Guide.pdfBroken Link

Timeline

Published: Mar 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-459015.3The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the usern CVE-2021-459036.1A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a CVE-2021-459045.4OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen.CVE-2021-459055.4OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen.CVE-2021-459065.4OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.CVE-2021-459077.8An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over CVE-2021-459087.8An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has little influence ove CVE-2021-459097.8An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow vulnerability in the DecodeLZW function. It allows an attacke CVE-2021-459107.8An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow within the main function. It allows an attacker to write data CVE-2021-459117.8An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow in the main function. It allows an attacker to write 2 bytes CVE-2021-459127.8An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS command CVE-2021-459137.2A hardcoded key in ControlUp Real-Time Agent (cuAgent.exe) before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel.