CVE-2021-45900
Medium
Description
Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie is assigned so that they can be uniquely identified. Certain APIs can be successfully executed without proper authentication. This can let an attacker impersonate as victim and make state changing requests on their behalf.
SeverityMedium
CVSS6.5
Exploit probability—
ProductVivoh Webinar Manager
PublishedMar 30, 2022
First seenMar 30, 2022
How to fix
Update
- vivoh webinar_manager3.6.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vivoh webinar_manager | v < 3.6.3.0 | 3.6.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.