{"api_version":"1","generated_at":"2026-07-23T20:58:54+00:00","cve":"CVE-2021-42330","urls":{"html":"https://cve.report/CVE-2021-42330","api":"https://cve.report/api/cve/CVE-2021-42330.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-42330","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-42330"},"summary":{"title":"CVE-2021-42330","description":"The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.","state":"PUBLIC","assigner":"cve@cert.org.tw","published_at":"2021-10-15 12:15:00","updated_at":"2022-08-12 16:29:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-5200-3d3ca-1.html","name":"N/A","refsource":"CONFIRM","tags":[],"title":"TWCERT/CC台灣電腦網路危機處理暨協調中心-欣河資訊 欣河教學平台系統 - Improper Authorization-1","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42330","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42330","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"42330","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xinheinformation","cpe5":"xinhe_teaching_platform_system","cpe6":"v2021","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"AKA":"TWCERT/CC","ASSIGNER":"cve@cert.org.tw","DATE_PUBLIC":"2021-10-15T11:38:00.000Z","ID":"CVE-2021-42330","STATE":"PUBLIC","TITLE":"ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"ShinHer StudyOnline System","version":{"version_data":[{"version_affected":"<=","version_value":"2021"}]}}]},"vendor_name":"ShinHer Information Co., LTD."}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-285 Improper Authorization"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://www.twcert.org.tw/tw/cp-132-5200-3d3ca-1.html","name":"https://www.twcert.org.tw/tw/cp-132-5200-3d3ca-1.html"}]},"solution":[{"lang":"eng","value":"Update ShinHer StudyOnline System to version v2021.08.20.01"}],"source":{"advisory":"TVN-202110002","discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2021-10-15 12:15:00","lastModifiedDate":"2022-08-12 16:29:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:xinheinformation:xinhe_teaching_platform_system:v2021:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"42330","Ordinal":"218295","Title":"CVE-2021-42330","CVE":"CVE-2021-42330","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"42330","Ordinal":"1","NoteData":"The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"42330","Ordinal":"2","NoteData":"2021-10-15","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"42330","Ordinal":"3","NoteData":"2021-10-15","Type":"Other","Title":"Modified"}]}}}