What’s Vulnerable › Vulnerabilities

CVE-2021-35060

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-11 · updated 2026-06-17
• Weakness: CWE-209

Description

/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system.

Affected products

• Openwaygroup Way4: before 1.2.278-2693 — fixed in 1.2.278-2693

How to fix

Upgrade to a fixed version: Openwaygroup Way4 1.2.278-2693. Check the vendor advisory for mitigations.

References

• https://gist.github.com/exviry/9527ce2ccdc0718d3ffd1e3ca62cf304
• https://www.openwaygroup.com/way4-platform
• https://gist.github.com/exviry/9527ce2ccdc0718d3ffd1e3ca62cf304
• https://www.openwaygroup.com/way4-platform

Get alerted when CVE-2021-35060 or the next vulnerability affects your stack