// For flags

CVE-2021-41573

 

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Hitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later allows information disclosure. If authenticated user creates a link to a file or folder while the system was running version 4.3.x or earlier and then shares the link and then later deletes the file or folder without deleting the link and before the link expires. If the system has been upgraded to version 4.4.5 or 4.5.0 a malicious user with the link could browse and download all files of the authenticated user that created the link .

Hitachi Content Platform Anywhere (HCP-AW) versiones 4.4.5 y posteriores, permiten una divulgación de información. Si un usuario autenticado crea un enlace a un archivo o carpeta mientras el sistema estaba ejecutando la versión 4.3.x o anterior, y luego comparte el enlace y más tarde elimina el archivo o la carpeta sin borrar el enlace y antes de que éste expire. Si el sistema ha sido actualizado a la versión 4.4.5 o 4.5.0, un usuario malicioso con el enlace podría navegar y descargar todos los archivos del usuario autenticado que creó el enlace

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-09-24 CVE Reserved
  • 2021-09-29 CVE Published
  • 2023-04-22 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-552: Files or Directories Accessible to External Parties
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hitachi
Search vendor "Hitachi"
 Content Platform Anywhere
Search vendor "Hitachi" for product "Content Platform Anywhere"
 >= 4.4.5
Search vendor "Hitachi" for product "Content Platform Anywhere" and version " >= 4.4.5"
-
Affected