CVE-2021-22860

EIC e-document system - Broken Authentication

State: Published
Severity: 9.8 Critical
Published: Mar 17, 2021
Updated: Sep 16, 2024
Reserved: Jan 6, 2021

Description

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary commends.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
e-document systemExcellent Infotek Corporation	0 3.0.2Affected 0 2.9Affected

References

https://www.twcert.org.tw/tw/cp-132-4518-c813c-1.html
https://gist.github.com/tonykuo76/17d497b3472a80a5e8914227e81e6fa3
https://www.chtsecurity.com/news/12929036-924b-4b89-8a0e-3e7155e19011

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.