Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities by Huachu Digital Technology Co.,Ltd.
CVE-2021-42336 (GCVE-0-2021-42336)
Vulnerability from nvd – Published: 2021-10-15 12:10 – Updated: 2024-09-16 16:33
VLAI
Title
Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization
Summary
The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters.
Severity
4.3 (Medium)
CWE
- CWE-285 - Improper Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Huachu Digital Technology Co.,Ltd. | Easytest |
Affected:
1705
|
Date Public
2021-10-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:38.261Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Easytest",
"vendor": "Huachu Digital Technology Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "1705"
}
]
}
],
"datePublic": "2021-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user\u2019s permission, remote attackers can access other users\u2019 and administrator\u2019s account information except password by crafting URL parameters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-15T12:10:40.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110008",
"discovery": "EXTERNAL"
},
"title": "Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
"ID": "CVE-2021-42336",
"STATE": "PUBLIC",
"TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Easytest",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1705"
}
]
}
}
]
},
"vendor_name": "Huachu Digital Technology Co.,Ltd."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user\u2019s permission, remote attackers can access other users\u2019 and administrator\u2019s account information except password by crafting URL parameters."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-285 Improper Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110008",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-42336",
"datePublished": "2021-10-15T12:10:40.380Z",
"dateReserved": "2021-10-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:33:19.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42335 (GCVE-0-2021-42335)
Vulnerability from nvd – Published: 2021-10-15 12:10 – Updated: 2024-09-16 19:05
VLAI
Title
Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS
Summary
Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack.
Severity
5.4 (Medium)
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Huachu Digital Technology Co.,Ltd. | Easytest |
Affected:
1705
|
Date Public
2021-10-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:38.430Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Easytest",
"vendor": "Huachu Digital Technology Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "1705"
}
]
}
],
"datePublic": "2021-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user\u2019s privilege, remote attackers can inject JavaScript and execute stored XSS attack."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-15T12:10:38.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110007",
"discovery": "EXTERNAL"
},
"title": "Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
"ID": "CVE-2021-42335",
"STATE": "PUBLIC",
"TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Easytest",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1705"
}
]
}
}
]
},
"vendor_name": "Huachu Digital Technology Co.,Ltd."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user\u2019s privilege, remote attackers can inject JavaScript and execute stored XSS attack."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110007",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-42335",
"datePublished": "2021-10-15T12:10:38.906Z",
"dateReserved": "2021-10-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:05:14.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42334 (GCVE-0-2021-42334)
Vulnerability from nvd – Published: 2021-10-15 12:10 – Updated: 2024-09-16 16:17
VLAI
Title
Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2
Summary
The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions.
Severity
8.8 (High)
CWE
- CWE-89 - SQL Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Huachu Digital Technology Co.,Ltd. | Easytest |
Affected:
1705
|
Date Public
2021-10-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:38.253Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Easytest",
"vendor": "Huachu Digital Technology Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "1705"
}
]
}
],
"datePublic": "2021-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-15T12:10:37.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110006",
"discovery": "EXTERNAL"
},
"title": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
"ID": "CVE-2021-42334",
"STATE": "PUBLIC",
"TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Easytest",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1705"
}
]
}
}
]
},
"vendor_name": "Huachu Digital Technology Co.,Ltd."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110006",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-42334",
"datePublished": "2021-10-15T12:10:37.398Z",
"dateReserved": "2021-10-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:17:44.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42333 (GCVE-0-2021-42333)
Vulnerability from nvd – Published: 2021-10-15 12:10 – Updated: 2024-09-16 23:56
VLAI
Title
Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1
Summary
The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions.
Severity
8.8 (High)
CWE
- CWE-89 - SQL Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Huachu Digital Technology Co.,Ltd. | Easytest |
Affected:
1705
|
Date Public
2021-10-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:38.290Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Easytest",
"vendor": "Huachu Digital Technology Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "1705"
}
]
}
],
"datePublic": "2021-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Easytest contains SQL injection vulnerabilities. After obtaining user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-15T12:10:35.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110005",
"discovery": "EXTERNAL"
},
"title": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
"ID": "CVE-2021-42333",
"STATE": "PUBLIC",
"TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Easytest",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1705"
}
]
}
}
]
},
"vendor_name": "Huachu Digital Technology Co.,Ltd."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Easytest contains SQL injection vulnerabilities. After obtaining user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110005",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-42333",
"datePublished": "2021-10-15T12:10:35.859Z",
"dateReserved": "2021-10-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:56:50.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42336 (GCVE-0-2021-42336)
Vulnerability from cvelistv5 – Published: 2021-10-15 12:10 – Updated: 2024-09-16 16:33
VLAI
Title
Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization
Summary
The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters.
Severity
4.3 (Medium)
CWE
- CWE-285 - Improper Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Huachu Digital Technology Co.,Ltd. | Easytest |
Affected:
1705
|
Date Public
2021-10-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:38.261Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Easytest",
"vendor": "Huachu Digital Technology Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "1705"
}
]
}
],
"datePublic": "2021-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user\u2019s permission, remote attackers can access other users\u2019 and administrator\u2019s account information except password by crafting URL parameters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-15T12:10:40.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110008",
"discovery": "EXTERNAL"
},
"title": "Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
"ID": "CVE-2021-42336",
"STATE": "PUBLIC",
"TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Easytest",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1705"
}
]
}
}
]
},
"vendor_name": "Huachu Digital Technology Co.,Ltd."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user\u2019s permission, remote attackers can access other users\u2019 and administrator\u2019s account information except password by crafting URL parameters."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-285 Improper Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110008",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-42336",
"datePublished": "2021-10-15T12:10:40.380Z",
"dateReserved": "2021-10-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:33:19.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42335 (GCVE-0-2021-42335)
Vulnerability from cvelistv5 – Published: 2021-10-15 12:10 – Updated: 2024-09-16 19:05
VLAI
Title
Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS
Summary
Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack.
Severity
5.4 (Medium)
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Huachu Digital Technology Co.,Ltd. | Easytest |
Affected:
1705
|
Date Public
2021-10-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:38.430Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Easytest",
"vendor": "Huachu Digital Technology Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "1705"
}
]
}
],
"datePublic": "2021-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user\u2019s privilege, remote attackers can inject JavaScript and execute stored XSS attack."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-15T12:10:38.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110007",
"discovery": "EXTERNAL"
},
"title": "Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
"ID": "CVE-2021-42335",
"STATE": "PUBLIC",
"TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Easytest",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1705"
}
]
}
}
]
},
"vendor_name": "Huachu Digital Technology Co.,Ltd."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user\u2019s privilege, remote attackers can inject JavaScript and execute stored XSS attack."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110007",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-42335",
"datePublished": "2021-10-15T12:10:38.906Z",
"dateReserved": "2021-10-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:05:14.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42334 (GCVE-0-2021-42334)
Vulnerability from cvelistv5 – Published: 2021-10-15 12:10 – Updated: 2024-09-16 16:17
VLAI
Title
Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2
Summary
The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions.
Severity
8.8 (High)
CWE
- CWE-89 - SQL Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Huachu Digital Technology Co.,Ltd. | Easytest |
Affected:
1705
|
Date Public
2021-10-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:38.253Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Easytest",
"vendor": "Huachu Digital Technology Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "1705"
}
]
}
],
"datePublic": "2021-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-15T12:10:37.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110006",
"discovery": "EXTERNAL"
},
"title": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
"ID": "CVE-2021-42334",
"STATE": "PUBLIC",
"TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Easytest",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1705"
}
]
}
}
]
},
"vendor_name": "Huachu Digital Technology Co.,Ltd."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110006",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-42334",
"datePublished": "2021-10-15T12:10:37.398Z",
"dateReserved": "2021-10-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:17:44.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42333 (GCVE-0-2021-42333)
Vulnerability from cvelistv5 – Published: 2021-10-15 12:10 – Updated: 2024-09-16 23:56
VLAI
Title
Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1
Summary
The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions.
Severity
8.8 (High)
CWE
- CWE-89 - SQL Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Huachu Digital Technology Co.,Ltd. | Easytest |
Affected:
1705
|
Date Public
2021-10-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:30:38.290Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Easytest",
"vendor": "Huachu Digital Technology Co.,Ltd.",
"versions": [
{
"status": "affected",
"version": "1705"
}
]
}
],
"datePublic": "2021-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Easytest contains SQL injection vulnerabilities. After obtaining user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-15T12:10:35.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110005",
"discovery": "EXTERNAL"
},
"title": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
"ID": "CVE-2021-42333",
"STATE": "PUBLIC",
"TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Easytest",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1705"
}
]
}
}
]
},
"vendor_name": "Huachu Digital Technology Co.,Ltd."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Easytest contains SQL injection vulnerabilities. After obtaining user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Easytest to version 2100"
}
],
"source": {
"advisory": "TVN-202110005",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2021-42333",
"datePublished": "2021-10-15T12:10:35.859Z",
"dateReserved": "2021-10-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:56:50.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}