title: ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-2
description: The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters.
problem types: CWE-285 Improper Authorization
affected:
{
product: ShinHer StudyOnline System
vendor: ShinHer Information Co., LTD.
versions:
lessThanOrEqual: 2021, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]
solutions: Update ShinHer StudyOnline System to version v2021.08.20.01