Read the docs
TI-2021-03317 Aliases CVE-2021-4461GHSA-vjp9-58v6-m6fw

Seeyon Zhiyuan OA Web Application System < 7.0 SP1 Authentication Bypass

Priority MEDIUM 49CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do. The decoded map values can influence session attributes without sufficient authentication/authorization checks, enabling attackers to assign a session to arbitrary user IDs. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:40.855917 UTC.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0049 42nd percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SeeyonZhiyuan OA Web Application Systemup to 7.0 SP1—No fix listedCNA
  • Zhiyuan OA Web Application System VendorSeeyon Affected up to 7.0 SP1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:seeyon:oa_web_application_system:*:*:*:*:*:*:*:*——Seeyon
  • cpe:2.3:a:seeyon:oa_web_application_system:*:*:*:*:*:*:*:* Versions — — ·Seeyon

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4461
  2. 2026-10-03 Alias added: GHSA-vjp9-58v6-m6fw

References

Exploit 3

  • TI-2025-01768 Seeyon Zhiyuan Interconnect FE Collaborative Office Platform addUser.jsp sql injection CVSS 4.0MEDIUM 6.9
  • TI-2025-04046 Seeyon Zhiyuan OA Web Application System Beetl Template EhrSalaryPayrollServiceImpl.class postData code injection CVSS 4.0MEDIUM 5.3
  • TI-2025-04044 Seeyon Zhiyuan OA Web Application System ZIP File M3CoreController.class download path traversal CVSS 4.0MEDIUM 5.3
  • TI-2025-02986 Seeyon Zhiyuan Interconnect FE Collaborative Office Platform check.js%70 sql injection CVSS 4.0MEDIUM 5.3
  • TI-2025-03543 Seeyon Zhiyuan OA Web Application System ssoproxy.jsp cross site scripting CVSS 4.0MEDIUM 5.1
  • TI-2025-03542 Seeyon Zhiyuan OA Web Application System URL Parameter date.jsp cross site scripting CVSS 4.0MEDIUM 5.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences