CVE-2021-38299

{
  "id": "CVE-2021-38299",
  "sourceIdentifier": "[email protected]",
  "published": "2021-09-27T06:15:07.910",
  "lastModified": "2026-11-05T19:59:32.573",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence."
    },
    {
      "lang": "es",
      "value": "Webauthn Framework versiones 3.3.x anteriores a 3.3.4, presenta un Control de Acceso Incorrecto. Un atacante que controla el sistema de un usuario es capaz de iniciar sesión en un servicio vulnerable usando un autenticador FIDO2 conectado sin pasar una comprobación de la presencia del usuario"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:spomky-labs:webauthn_framework:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.3.0",
              "versionEndExcluding": "3.3.4",
              "matchCriteriaId": "6005A774-4C6B-42E3-AC33-F21989A4D7BE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:spomky-labs:webauthn_framwork:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.2.9",
              "matchCriteriaId": "1A99E98A-BE7F-42AB-9B17-0610A13347A1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/web-auth/webauthn-framework/releases",
      "source": "[email protected]",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2021-1-fehlende-ueberpruefung-von-user-presence-in-webauthn-framework/",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/web-auth/webauthn-framework/releases",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2021-1-fehlende-ueberpruefung-von-user-presence-in-webauthn-framework/",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}