CVE-2021-22855 CRITICAL

CVE-2021-22855: Soar Cloud System Co., Ltd. HR Portal - Arbitrary Code Execution

Vendor Soar Cloud System Co., Ltd.
Product HR Portal
Weakness CWE-502 · Unsafe deserialization
Published February 17, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands.

Key dates

02Disclosure timeline

February 17, 2021 CVE published
September 16, 2024 Record updated