CVE-2020-1338201.07.2020, 15:15openSIS through 7.4 has Incorrect Access Control.EnginsightProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVectorNISTNIST9.1 CRITICALNETWORKLOWNONECVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NmitreCNA------CVEADP------Base ScoreCVSS 3.xEPSS ScorePercentile: 98%VendorProductVersionos4edopensis𝑥≤ 7.4𝑥= Vulnerable software versionsKnown Exploits!http://packetstormsecurity.com/files/158255/openSIS-7.4-Incorrect-Access-Control.htmlhttp://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.htmlhttp://packetstormsecurity.com/files/158255/openSIS-7.4-Incorrect-Access-Control.htmlhttp://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.htmlCommon Weakness EnumerationCWE-306 - Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.Referenceshttp://packetstormsecurity.com/files/158255/openSIS-7.4-Incorrect-Access-Control.htmlhttp://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.htmlhttps://github.com/OS4ED/openSIS-Responsive-Design/commits/masterhttp://packetstormsecurity.com/files/158255/openSIS-7.4-Incorrect-Access-Control.htmlhttp://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.htmlhttps://github.com/OS4ED/openSIS-Responsive-Design/commits/master