Cyber Resilience

CVE-2021-36124

Critical

Published: 13 July 2021

Published
13 July 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0054 68.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-36124 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Echobh Sharecare. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 31.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as…

more

SQL injection.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

echobh
sharecare
8.15.5

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-306 CWE-862

Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.

addresses: CWE-306 CWE-862

Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.

addresses: CWE-862 CWE-306

Always invoking the reference monitor prevents missing authorization checks for protected resources.

addresses: CWE-306 CWE-862

Auditing sessions makes it possible to detect access to critical functions without required authentication.

addresses: CWE-306 CWE-862

The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.

addresses: CWE-306 CWE-862

Certification assesses that critical functions have required authentication controls in place.

addresses: CWE-862 CWE-306

Requiring authorization servers ensures authorization is performed for protected functions.

addresses: CWE-306 CWE-862

Tailoring determines which functions require authentication and selects the appropriate baseline or compensating authentication controls.

References