« Volver al listado

CVE-2021-22851

Estado: ModificadaCrítica (9.8)—

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hgiga — Oaklouds Openid

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22851",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "HGiga",
          "product": "OAKSv20 OAKlouds-document_v3 2.0",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.0-54",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "HGiga",
          "product": "OAKSv30 OAKlouds-document_v3 3.0",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "3.0-54",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-01-19T10:15:15.807",
  "references": [
    {
      "url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data."
    },
    {
      "lang": "es",
      "value": "El producto HGiga EIP, contiene vulnerabilidad de inyección SQL. Los atacantes pueden inyectar comandos SQL en un parámetro URL específico (página de administración de documentos) para obtener el esquema y los datos de la base de datos"
    }
  ],
  "lastModified": "2026-06-17T03:37:52.777",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hgiga:oaklouds_openid:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FD039C1-D416-485C-A413-5D6EF6B31E4D",
              "versionEndExcluding": "2.0-54",
              "versionStartIncluding": "2.0"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:oaklouds_openid:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6FB0F7D-7B74-4485-86FE-30A0A7CF9E0B",
              "versionEndExcluding": "3.0-54",
              "versionStartIncluding": "3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}