Description
The access control in CemiPark software does not properly validate user-entered data, which allows the authentication bypass. An attacker who has network access to the login panel can log in with administrator rights to the application.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- CEMI Tomasz Pawełek / CemiPark4.5 – 4.5
- CEMI Tomasz Pawełek / CemiPark4.7 – 4.7
- CEMI Tomasz Pawełek / CemiPark5.03 – 5.03