CVE-2021-4461: Seeyon Zhiyuan OA Web Application System < 7.0 SP1 Authentication Bypass
Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the enc parameter in thirdpartyController.do. The decoded map values can influence session attributes without sufficient authentication/authorization checks, enabling attackers to assign a session to arbitrary user IDs. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:40.855917 UTC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4461?
CVE-2021-4461 is considered to be of high severity due to its potential for unauthorized session manipulation.
How do I fix CVE-2021-4461?
To fix CVE-2021-4461, upgrade Seeyon Zhiyuan OA Web Application System to a version later than 7.0 SP1.
What kind of attack does CVE-2021-4461 enable?
CVE-2021-4461 enables attackers to influence session attributes without adequate authentication or authorization.
Which versions of Seeyon Zhiyuan OA Web Application System are affected by CVE-2021-4461?
CVE-2021-4461 affects Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1.
What does CVE-2021-4461 exploit in the application?
CVE-2021-4461 exploits improper decoding and parsing of the 'enc' parameter in the thirdpartyController.do function.