CVE-2021-43355
Last modified
CVE-2021-43355 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypass the client-side checks. EPSS estimates a 0.98% chance of exploitation in the next 30 days.
Description
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypass the client-side checks. An attacker with knowledge of the service user could circumvent the client-side control and login with service privileges.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fresenius-Kabi | Agilia Partner Maintenance Software | <= 3.3.0 |
| Fresenius-Kabi | Vigilant Centerium | 1.0 |
| Fresenius-Kabi | Vigilant Insight | 1.0 |
| Fresenius-Kabi | Vigilant Mastermed | 1.0 |
| Fresenius-Kabi | Agilia Connect Firmware | <= d25 |
| Fresenius-Kabi | Link\+ Agilia Firmware | < 3.0 |
| Fresenius-Kabi | Link\+ Agilia Firmware | 3.0 |
References
- https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01Third Party Advisory, US Government Resource
- https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-43355?
How severe is CVE-2021-43355?
How do I fix CVE-2021-43355?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-43339In Ericsson Network Location before 2021-07-31, it is possib…8.8
- CVE-2021-4334The Fancy Product Designer plugin for WordPress is vulnerabl…8.8
- CVE-2021-4335The Fancy Product Designer plugin for WordPress is vulnerabl…6.3
- CVE-2021-43350An unauthenticated Apache Traffic Control Traffic Ops user c…9.8
- CVE-2021-43351Rejected reason: This is unused.
- CVE-2021-43353The Crisp Live Chat WordPress plugin is vulnerable to Cross-…8.8
- CVE-2021-43358Sunnet eHRD has inadequate filtering for special characters …7.5
- CVE-2021-43359Sunnet eHRD has broken access control vulnerability, which a…8.8
- CVE-2021-4336A vulnerability was found in ITRS Group monitor-ninja up to …9.8
- CVE-2021-43360Sunnet eHRD e-mail delivery task schedule’s serialization fu…8.8
- CVE-2021-43361Improper Neutralization of Special Elements used in an SQL C…9.8
- CVE-2021-43362Improper Neutralization of Special Elements used in an SQL C…9.8
Are you affected by CVE-2021-43355?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST