1. Home
  2. CVE Database
  3. CVE-2021-43175
HIGH · 7.5

CVE-2021-43175

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API ...

Vulnerability Description

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
GoautodialGoautodial4
GoautodialGoautodial Api2

Related Weaknesses (CWE)

CWE-305CWE-287

References

FAQ

What is CVE-2021-43175?

CVE-2021-43175 is a vulnerability with a CVSS score of 7.5 (HIGH). The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API ...

How severe is CVE-2021-43175?

CVE-2021-43175 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-43175?

Check the references section above for vendor advisories and patch information. Affected products include: Goautodial Goautodial, Goautodial Goautodial Api.