CVE-2021-47701
Published: 09 December 2025
Description
OpenBMCS 2.4 allows an attacker to escalate privileges from a read user to an admin user by manipulating permissions and exploiting a vulnerability in the update_user_permissions.php script. Attackers can submit a malicious HTTP POST request to PHP scripts in '/plugins/useradmin/'…
more
directory.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to the update_user_permissions.php script, directly addressing the CWE-862 missing authorization that enables privilege escalation.
Implements least privilege to restrict read-only users from modifying permissions, limiting the feasibility and impact of escalation to admin privileges.
Validates HTTP POST inputs to the useradmin directory scripts, preventing manipulation of permissions through crafted requests.
Security SummaryAI
CVE-2021-47701 is a privilege escalation vulnerability affecting OpenBMCS version 2.4, specifically in the update_user_permissions.php script located in the '/plugins/useradmin/' directory. The flaw, classified under CWE-862 (Missing Authorization), allows an attacker to manipulate user permissions through a malicious HTTP POST request to PHP scripts in that directory. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity with network accessibility, low attack complexity, and requirements for low privileges.
An authenticated attacker with read-only user privileges can exploit this vulnerability remotely by submitting a crafted POST request to the affected endpoint. Successful exploitation enables escalation to administrator privileges, potentially granting full control over the OpenBMCS instance, including high-impact confidentiality, integrity, and availability violations as per the CVSS metrics.
Advisories from VulnCheck, Zero Science Labs, and an Exploit-DB entry (exploit 50669) document the issue, confirming the privilege escalation path and providing proof-of-concept details, though specific patch information or mitigation steps are outlined in those resources. The CVE was published on 2025-12-09.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a privilege escalation flaw (CWE-862 Missing Authorization) allowing low-privileged authenticated users to escalate to administrator via crafted HTTP POST requests to user permission scripts, directly mapping to Exploitation for Privilege Escalation.