VULNERABILITY INTELLIGENCE

CVE-2021-42337

CVSS score4.3 MEDIUM
EPSS probability0.90%
CISA KEVNot currently listed
Published2021-11-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters.

Weakness classification

  • twcert@cert.org.tw: CWE-285
  • nvd@nist.gov: NVD-CWE-Other

Primary references