CVE-2021-43175
- State
- Published
- Severity
- Not scored
- Published
- Dec 7, 2021
- Updated
- Aug 4, 2024
- Reserved
- Nov 1, 2021
Description
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Scores
The record has no CVSS score.
Weaknesses
- CWE-305 Authentication Bypass by Primary Weakness
Affected Products
| Product | Versions |
|---|---|
GOautodial APIGOautodial |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.