9.8

CVE-2021-27215

Exploit
An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces (Admin, Userweb, Sidechannel) can use different methods to perform the authentication of a user. A specific authentication method during login does not check the provided data (when a certain manipulation occurs) and returns OK for any authentication request. This allows an attacker to login to the admin panel as a user of his choice, e.g., the root user (with highest privileges) or even a non-existing user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Genua ≫ Genuagate Version <= 9.0
Genua ≫ Genuagate Version >= 10.0 <= 10.1
Genua ≫ Genuagate Version 9.0 Update -
Genua ≫ Genuagate Version 9.0 Update p1
Genua ≫ Genuagate Version 9.0 Update p10
Genua ≫ Genuagate Version 9.0 Update p11
Genua ≫ Genuagate Version 9.0 Update p12
Genua ≫ Genuagate Version 9.0 Update p13
Genua ≫ Genuagate Version 9.0 Update p14
Genua ≫ Genuagate Version 9.0 Update p15
Genua ≫ Genuagate Version 9.0 Update p16
Genua ≫ Genuagate Version 9.0 Update p17
Genua ≫ Genuagate Version 9.0 Update p18
Genua ≫ Genuagate Version 9.0 Update p2
Genua ≫ Genuagate Version 9.0 Update p3
Genua ≫ Genuagate Version 9.0 Update p4
Genua ≫ Genuagate Version 9.0 Update p5
Genua ≫ Genuagate Version 9.0 Update p6
Genua ≫ Genuagate Version 9.0 Update p7
Genua ≫ Genuagate Version 9.0 Update p8
Genua ≫ Genuagate Version 9.0 Update p9
Genua ≫ Genuagate Version 9.6.0 Update -
Genua ≫ Genuagate Version 9.6.0 Update p1
Genua ≫ Genuagate Version 9.6.0 Update p2
Genua ≫ Genuagate Version 9.6.0 Update p3
Genua ≫ Genuagate Version 9.6.0 Update p4
Genua ≫ Genuagate Version 9.6.0 Update p5
Genua ≫ Genuagate Version 9.6.0 Update p6
Genua ≫ Genuagate Version 10.1 Update -
Genua ≫ Genuagate Version 10.1 Update p1
Genua ≫ Genuagate Version 10.1 Update p2
Genua ≫ Genuagate Version 10.1 Update p3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.35% 0.815
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://kunde.genua.de/en/overview/genugate.html
Patch
Vendor Advisory
https://sec-consult.com/vulnerability-lab/advisory/authentication-bypass-genua-genugate/
Third Party Advisory
Exploit
https://www.genua.de/en/it-security-solutions/high-resistance-firewall-genugate
Product