title: ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1
description: The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.
problem types: CWE-285 Improper Authorization
affected:
{
product: ShinHer StudyOnline System
vendor: ShinHer Information Co., LTD.
versions:
lessThanOrEqual: 2021, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Update ShinHer StudyOnline System to version v2021.08.20.01