CVE-2021-32543: SysJust CTS Web - Broken Authentication

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-28 · updated 2026-06-17
Weakness: CWE-287

Description

The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access other accounts and trade in the stock market with spoofed identity.

Affected products

SysJust CTS Web: before 2021.3.24 — fixed in 2021.3.24

How to fix

Upgrade to a fixed version: SysJust CTS Web 2021.3.24. Check the vendor advisory for mitigations.

References

https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344
https://www.twcert.org.tw/tw/cp-132-4759-92eab-1.html
https://www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344
https://www.twcert.org.tw/tw/cp-132-4759-92eab-1.html

Get alerted when CVE-2021-32543 or the next vulnerability affects your stack