CVE-2021-37786
Last modified
CVE-2021-37786 is a medium-severity vulnerability rated 4.6/10 on the CVSS scale. Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptional conditions. This affects COVID Certificate App IOS 2.2.0 and below affected, patch in progress and COVID Certificate Check App IOS 2.2.0 and below affected, patch in progress. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptional conditions. This affects COVID Certificate App IOS 2.2.0 and below affected, patch in progress and COVID Certificate Check App IOS 2.2.0 and below affected, patch in progress. A denial of service (physically proximate) could be caused by scanning a crafted QR code.
Metrics
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bag | Covid Certificate | <= 2.2.0 |
References
- https://github.com/admin-ch/CovidCertificate-App-iOS/issues/146Exploit, Issue Tracking, Third Party Advisory
- https://github.com/admin-ch/CovidCertificate-App-iOS/issues/146Exploit, Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-37786?
How severe is CVE-2021-37786?
How do I fix CVE-2021-37786?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-37774An issue was discovered in function httpProcDataSrv in TL-WD…8
- CVE-2021-37777Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Refer…7.5
- CVE-2021-37778There is a buffer overflow in gps-sdr-sim v1.0 when parsing …9.8
- CVE-2021-3778vim is vulnerable to Heap-based Buffer Overflow7.8
- CVE-2021-37781Employee Record Management System v 1.2 is vulnerable to Cro…5.4
- CVE-2021-37782Employee Record Management System v 1.2 is vulnerable to SQL…9.8
- CVE-2021-37787The unprivileged administrative interface in ABO.CMS version…6.5
- CVE-2021-37788A vulnerability in the web UI of Gurock TestRail v5.3.0.3603…5.4
- CVE-2021-37789stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_…8.1
- CVE-2021-3779A malicious MySQL server can request local file content from…6.5
- CVE-2021-37791MyAdmin v1.0 is affected by an incorrect access control vuln…4.9
- CVE-2021-37794A stored cross-site scripting (XSS) vulnerability exists in …5.4
Are you affected by CVE-2021-37786?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST