CVE-2021-22855

Soar Cloud System Co., Ltd. HR Portal - Arbitrary Code Execution

State: Published
Severity: 9.8 Critical
Published: Feb 17, 2021
Updated: Sep 16, 2024
Reserved: Jan 6, 2021

Description

The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
HR PortalSoar Cloud System Co., Ltd.	0 7.3.2020.1013Affected

References

https://www.twcert.org.tw/tw/cp-132-4405-2ddde-1.html
https://www.chtsecurity.com/news/d334641f-2b28-4eab-a5ed-c6ec6740557e

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.