CVE-2021-41554

Name of the Vulnerable Software and Affected Versions ARCHIBUS Web Central version 21.3.3.815

Description The issue arises from the software's failure to properly validate requests for access to data and functionality in several affected endpoints: "/archibus/schema/ab-edit-users.axvw", "/archibus/schema/ab-data-dictionary-table.axvw", "/archibus/schema/ab-schema-add-field.axvw", and "/archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw". This allows any authenticated user to access pages not intended for them, including the administrative console for user management, by directly requesting access via URL. A malicious user can exploit this to modify all users' profiles, elevate privileges to administrative levels, create or delete any type of user, and even modify other users' emails through a misconfiguration of the username parameter on the user profile page.

Recommendations For version 21.3.3.815, consider upgrading to a recent version, such as version 26, to fix the issue. As a temporary workaround, restrict access to the administrative console and limit modifications to user profiles until an upgrade can be performed. Additionally, review and correct any misconfigurations of the username parameter to prevent unauthorized email modifications.