Vulnerability Description
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Eigentech | Natural Language Processing | 3.10.1 |
References
- https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38617
- https://eigentech.com/Vendor Advisory
- https://excellium-services.com/cert-xlm-advisory/Third Party Advisory
- https://excellium-services.com/cert-xlm-advisory/CVE-2021-38617Third Party Advisory
- https://eigentech.com/Vendor Advisory
- https://excellium-services.com/cert-xlm-advisory/Third Party Advisory
- https://excellium-services.com/cert-xlm-advisory/CVE-2021-38617Third Party Advisory
FAQ
What is CVE-2021-38617?
CVE-2021-38617 is a vulnerability with a CVSS score of 8.8 (HIGH). In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privile...
How severe is CVE-2021-38617?
CVE-2021-38617 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-38617?
Check the references section above for vendor advisories and patch information. Affected products include: Eigentech Natural Language Processing.