CVE Vulnerabilities

CVE-2021-28171

Reliance on Cookies without Validation and Integrity Checking

Published: Apr 06, 2021 | Modified: Jul 29, 2022
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data in the Cookie.

Weakness

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Affected Software

Name Vendor Start Version End Version
Deltaflow Deltaflow_project 4.0 (including) 7.7 (excluding)

Potential Mitigations

References