CVE-2021-41382

published 2021-09-22

CVE-2021-41382: Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.

Priority P2 59 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I H A N

EXPLOIT

Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
plasticscm	plastic_scm	< 10.0.16.5622	10.0.16.5622

Detection & IOCs extracted from sources · hover to see the quote

url target.com/account/register↗

url target.com/configuration/authentication↗

url target.com/webui/repos↗

url target.com/account↗

• → Monitor for unauthenticated HTTP GET/POST requests to the /account/register path on Plastic SCM WebAdmin instances, which should not be publicly accessible and indicates an attempt to reset the administrator password without prior authentication. ↗
• → Alert on unauthenticated or anomalous access to /configuration/authentication endpoint on Plastic SCM WebAdmin, which is abused to change arbitrary user passwords post admin account takeover. ↗
• → Use the Shodan dork 'title:"Plastic SCM"' to identify internet-exposed Plastic SCM WebAdmin instances that may be vulnerable. ↗

• · The vulnerability affects Plastic SCM versions strictly before 10.0.16.5622; the WebAdmin server management interface must be network-accessible for exploitation. Restrict WebAdmin to trusted networks or localhost to mitigate exposure. ↗
• · The exploit was tested and confirmed functional on Chrome, Firefox, and Edge browsers, indicating it is a purely web-based attack requiring no special client tooling. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.