{"containers": {"cna": {"affected": [{"product": "Health Report System", "vendor": "Carinal Tien Hospital", "versions": [{"status": "unknown", "version": "0"}]}], "datePublic": "2021-12-30T00:00:00", "descriptions": [{"lang": "en", "value": "Carinal Tien Hospital Health Report System\u2019s login page has improper authentication, a remote attacker can acquire another general user\u2019s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the service partially unavailable to the user."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-12-29T07:15:15", "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.twcert.org.tw/tw/cp-132-5429-4185b-1.html"}], "source": {"advisory": "TVN-202111005", "discovery": "EXTERNAL"}, "title": "Carinal Tien Hospital Health Report System - Authorization Bypass Through User-Controlled Key", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "TWCERT/CC", "ASSIGNER": "cve@cert.org.tw", "DATE_PUBLIC": "2021-12-30T07:06:00.000Z", "ID": "CVE-2021-44160", "STATE": "PUBLIC", "TITLE": "Carinal Tien Hospital Health Report System - Authorization Bypass Through User-Controlled Key"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Health Report System", "version": {"version_data": [{"version_affected": "?", "version_value": "0"}]}}]}, "vendor_name": "Carinal Tien Hospital"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Carinal Tien Hospital Health Report System\u2019s login page has improper authentication, a remote attacker can acquire another general user\u2019s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the service partially unavailable to the user."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}]}, "references": {"reference_data": [{"name": "https://www.twcert.org.tw/tw/cp-132-5429-4185b-1.html", "refsource": "MISC", "url": "https://www.twcert.org.tw/tw/cp-132-5429-4185b-1.html"}]}, "source": {"advisory": "TVN-202111005", "discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "cveId": "CVE-2021-44160", "datePublished": "2021-12-30T00:00:00", "dateReserved": "2021-11-23T00:00:00", "dateUpdated": "2021-12-29T07:15:15", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cth:carinal_tien_hospital_health_report_system:-:*:*:*:*:*:*:*", "matchCriteriaId": "89569AAC-76FE-4E90-BAD6-CFB7520741D3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Carinal Tien Hospital Health Report System\u2019s login page has improper authentication, a remote attacker can acquire another general user\u2019s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the service partially unavailable to the user."}, {"lang": "es", "value": "La p\u00e1gina de inicio de sesi\u00f3n de Carinal Tien Hospital Health Report System presenta una autenticaci\u00f3n inapropiada, un atacante remoto puede adquirir el privilegio de otro usuario general al modificar el par\u00e1metro de la cookie sin autenticaci\u00f3n. El atacante puede entonces llevar a cabo operaciones limitadas en el sistema o modificar los datos, haciendo que el servicio est\u00e9 parcialmente no disponible para el usuario"}], "id": "CVE-2021-44160", "lastModified": "2022-08-09T01:23:43.853", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "twcert@cert.org.tw", "type": "Primary"}]}, "published": "2021-12-29T08:15:06.703", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-5429-4185b-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-639"}], "source": "twcert@cert.org.tw", "type": "Secondary"}]}

{}