CVE-2021-46249
Last modified
CVE-2021-46249 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.. EPSS estimates a 0.63% chance of exploitation in the next 30 days.
Description
An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Scratchoauth2 Project | Scratchoauth2 | < 2021-04-12 |
References
- https://github.com/ScratchVerifier/ScratchOAuth2/commit/d856dc704b2504cd3b92cf089fdd366dd40775d6Patch, Third Party Advisory
- https://github.com/ScratchVerifier/ScratchOAuth2/commit/d856dc704b2504cd3b92cf089fdd366dd40775d6Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-46249?
How severe is CVE-2021-46249?
How do I fix CVE-2021-46249?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-46239The binary MP4Box in GPAC v1.1.0 was discovered to contain a…5.5
- CVE-2021-46240A NULL pointer dereference vulnerability exists in GPAC v1.1…5.5
- CVE-2021-46242HDF5 v1.13.1-1 was discovered to contain a heap-use-after fr…8.8
- CVE-2021-46243An untrusted pointer dereference vulnerability exists in HDF…6.5
- CVE-2021-46244A Divide By Zero vulnerability exists in HDF5 v1.13.1-1 vis …6.5
- CVE-2021-46247The use of a hard-coded cryptographic key significantly incr…7.5
- CVE-2021-46250An issue in SOA2Login::commented of ScratchOAuth2 before com…10
- CVE-2021-46251A reflected cross-site scripting (XSS) in ScratchOAuth2 befo…6.1
- CVE-2021-46252A Cross-Site Request Forgery (CSRF) in RequirementsBypassPag…6.5
- CVE-2021-46253A cross-site scripting (XSS) vulnerability in the Create Pos…5.4
- CVE-2021-46255eyouCMS V1.5.5-UTF8-SP3_1 suffers from Arbitrary file deleti…8.1
- CVE-2021-46262Tenda AC Series Router AC11_V02.03.01.104_CN was discovered …9.8
Are you affected by CVE-2021-46249?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST