CVE-2021-32541: SysJust CTS Web - Broken Access Control

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-28 · updated 2026-06-17
Weakness: CWE-287

Description

The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can send a large number of valid usernames, and force those logged-in account to log out, causing the user to be unable to access the services

Affected products

SysJust CTS Web: before 2021.3.24 — fixed in 2021.3.24

How to fix

Upgrade to a fixed version: SysJust CTS Web 2021.3.24. Check the vendor advisory for mitigations.

References

https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344
https://www.twcert.org.tw/tw/cp-132-4757-893eb-1.html
https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344
https://www.twcert.org.tw/tw/cp-132-4757-893eb-1.html

Get alerted when CVE-2021-32541 or the next vulnerability affects your stack