CVE-2021-45918

NHI’s health insurance web service component has insufficient validation for input string length, which can result in heap-based buffer overflow attack. A remote attacker can exploit this vulnerability to flood the memory space reserved for the program, in order to terminate service without authentication, which requires a system restart to recover service.

• CVE ID
• CVE-2021-45918

• Assigner
• twcert@cert.org.tw

• Vulnerability Status
• Analyzed

• Published Version
• 2022-06-20T06:15:08

• Last Modified Date
• 2022-06-27T18:28:20

• Version
• 2.0

• Vector String
• AV:N/AC:L/Au:N/C:N/I:N/A:C

• Access Vector
• NETWORK

• Access Compatibility
• LOW

• Authentication
• NONE

• Confidentiality Impact
• NONE

• Integrity Impact
• NONE

• Availability Impact
• COMPLETE

• Base Score
• 7.8

• Severity
• HIGH

• Exploitability Score
• 10

• Impact Score
• 6.9

• Version
• 3.1

• Vector String
• CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Attack Vector
• NETWORK

• Attack Compatibility
• LOW

• Privileges Required
• NONE

• User Interaction
• NONE

• Scope
• UNCHANGED

• Confidentiality Impact
• NONE

• Availability Impact
• HIGH

• Base Score
• 7.5

• Base Severity
• HIGH

• Exploitability Score
• 3.9

• Impact Score
• 3.6