Unscored CVE-2021-27514 EUVD-2021-14268GHSA-v598-3w4j-2787

EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication…

Published Feb 21, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Description

EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (such as in CVE-2021-27513 exploitation).

References

https://github.com/ArianeBlow/exploit-eyesofnetwork5.3.10/blob/main/PoC-BruteForceID-arbitraty-file-upload-RCE-PrivEsc.py
https://github.com/EyesOfNetworkCommunity/eonweb/issues/87