CVE-2021-41573 : Security Advisory and Response

Hitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later allows information disclosure through a specific vulnerability.

Understanding CVE-2021-41573

What is CVE-2021-41573?

The CVE-2021-41573 vulnerability in Hitachi Content Platform Anywhere allows a malicious user to browse and download files of an authenticated user who created a link under certain conditions.

The Impact of CVE-2021-41573

The vulnerability has a high severity level with a CVSS base score of 7.5 due to its potential for disclosing sensitive information.

Technical Details of CVE-2021-41573

Vulnerability Description

The issue arises in HCP-AW versions 4.4.5 and 4.5.0, where a user could access files of another user if specific actions are taken before link expiration.

Affected Systems and Versions

Hitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later

Exploitation Mechanism

An authenticated user creating a link to a file or folder in older versions (4.3.x or earlier), then sharing the link, and later deleting the file/folder without removing the link

Mitigation and Prevention

Immediate Steps to Take

Regularly review and delete unnecessary file sharing links
Monitor access logs for unusual file downloads

Long-Term Security Practices

Implement strict file access controls and user permissions
Conduct security training to educate users on safe file sharing practices

Patching and Updates

Apply patches and updates from Hitachi to address the vulnerability