CVE-2021-41553

In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the testers to modify the application logic. It is also possible to set the value of the session token, client-side, simply by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field. The application, following the login, does not assign a new token, continuing to keep the inserted one, as the identifier of the entire session. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020

• CWE-384

• https://www.gruppotim.it/redteamThird Party Advisory
• https://www.gruppotim.it/redteamThird Party Advisory

Published

Oct 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41546A vulnerability has been identified in RUGGEDCOM ROX MX5000 …7.5
• CVE-2021-41547A vulnerability has been identified in Teamcenter Active Wor…7.2
• CVE-2021-4155A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL …5.5
• CVE-2021-41550Leostream Connection Broker 9.0.40.17 allows administrator t…7.2
• CVE-2021-41551Leostream Connection Broker 9.0.40.17 allows administrators …4.9
• CVE-2021-41552CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Com…8.8
• CVE-2021-41554ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does n…8.8
• CVE-2021-41555In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), XS…6.1
• CVE-2021-41556sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 al…10
• CVE-2021-41557Sofico Miles RIA 2020.2 Build 127964T is affected by Stored …5.4
• CVE-2021-41558The set_user extension module before 3.0.0 for PostgreSQL al…9.8
• CVE-2021-41559Silverstripe silverstripe/framework 4.8.1 has a quadratic bl…6.5