HIGH🇵🇱 Wersja polska

CVE-2021-20874

CVSS 7.5v3.1pub. 2021-12-24upd. 2024-11-21

Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain sensitive information via unspecified vectors.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Groupsession

    APP
    Groupsession
    ≤ 5.1.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2025-58576MEDIUM5.1ten sam produkt

Cross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession b...

CVE-2025-54407MEDIUM5.1ten sam produkt

Stored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession ...

CVE-2025-53523MEDIUM4.8ten sam produkt

Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession...

CVE-2025-57883MEDIUM5.1ten sam produkt

Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSessi...

CVE-2025-61950MEDIUM5.3ten sam produkt

In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization chec...