CVE-2021-41573
First published: Wed Sep 29 2021(Updated: )
Hitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later allows information disclosure. If authenticated user creates a link to a file or folder while the system was running version 4.3.x or earlier and then shares the link and then later deletes the file or folder without deleting the link and before the link expires. If the system has been upgraded to version 4.4.5 or 4.5.0 a malicious user with the link could browse and download all files of the authenticated user that created the link .
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hitachi Content Platform Anywhere | >=4.4.5 | |
| >=4.4.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-41573?
The severity of CVE-2021-41573 is classified as medium due to the potential for information disclosure.
How do I fix CVE-2021-41573?
To fix CVE-2021-41573, ensure that all links to deleted files or folders are also deleted to prevent unauthorized access.
Which versions of Hitachi Content Platform Anywhere are affected by CVE-2021-41573?
CVE-2021-41573 affects Hitachi Content Platform Anywhere versions 4.4.5 and later if links to files or folders from earlier versions are not properly managed.
Is user authentication sufficient to prevent CVE-2021-41573 exploitation?
No, even authenticated users can inadvertently expose sensitive information due to the improper handling of file or folder links.
What type of vulnerability is CVE-2021-41573?
CVE-2021-41573 is primarily an information disclosure vulnerability stemming from inadequate link management.
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/tags
- agent/source
- vendor/hitachi
- canonical/hitachi content platform anywhere
- version/hitachi content platform anywhere/4.4.5