CVE-2021-41573: High severity Hitachi Content Platform Anywhere vulnerability
Hitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later allows information disclosure. If authenticated user creates a link to a file or folder while the system was running version 4.3.x or earlier and then shares the link and then later deletes the file or folder without deleting the link and before the link expires. If the system has been upgraded to version 4.4.5 or 4.5.0 a malicious user with the link could browse and download all files of the authenticated user that created the link .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hitachi Content Platform Anywhere (HCP-AW)to a version that resolves this vulnerability.Fixed in 4.4.5 - Upgrade
Upgrade
Hitachi Content Platform Anywhere (HCP-AW)to a version that resolves this vulnerability.Fixed in 4.5.0 - Compensating control
After upgrading to HCP-AW versions 4.4.5 or 4.5.0, ensure any previously created share links (made while the system was running 4.3.x or earlier) are deleted so they cannot be used to browse/download files after the underlying file/folder is deleted and before the link expires.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41573?
The severity of CVE-2021-41573 is classified as medium due to the potential for information disclosure.
How do I fix CVE-2021-41573?
To fix CVE-2021-41573, ensure that all links to deleted files or folders are also deleted to prevent unauthorized access.
Which versions of Hitachi Content Platform Anywhere are affected by CVE-2021-41573?
CVE-2021-41573 affects Hitachi Content Platform Anywhere versions 4.4.5 and later if links to files or folders from earlier versions are not properly managed.
Is user authentication sufficient to prevent CVE-2021-41573 exploitation?
No, even authenticated users can inadvertently expose sensitive information due to the improper handling of file or folder links.
What type of vulnerability is CVE-2021-41573?
CVE-2021-41573 is primarily an information disclosure vulnerability stemming from inadequate link management.