CVE-2021-37381

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.18.8High EPSS percentile48th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixNone yetNo fix or workaround published

Published 2021-08-06Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Confirm whether your school runs Southsoft GMIS 5.0 and whether users can access it while signed in.
Ask your software vendor whether a supported update or security advisory is available; no fixed version is currently known.
Until guidance is available, warn GMIS users not to open unexpected links while signed in and have IT restrict access to trusted networks where practical.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Southsoft GMIS 5.0 is vulnerable to CSRF attacks. Attackers can access other users' private information such as photos through CSRF. For example: any student's photo information can be accessed through /gmis/(S([1]))/student/grgl/PotoImageShow/?bh=[2]. Among them, the code in [1] is a random string generated according to the user's login related information. It can protect the user's identity, but it can not effectively prevent unauthorized access. The code in [2] is the student number of any student. The attacker can carry out CSRF attack on the system by modifying [2] without modifying [1].

In plain language

Written by AI from the record

Southsoft GMIS 5.0 can expose student photos if a logged-in user is tricked into opening a malicious link, so schools using it should act soon; no vendor fix is known.

CSRF in Southsoft GMIS 5.0 permits an attacker to induce authenticated requests that retrieve other students’ photo records by altering a student identifier.

If you're affected

Student photo exposure
Privacy breach
Student-record access
Reputational harm

What is it

This flaw can let someone use a signed-in person’s browser to request another student’s photo without that person realizing it. It is like being persuaded to hand a receptionist a pre-filled request slip: the receptionist sees a valid employee badge and returns a file that should not have been requested.

Who is affected

This matters to schools or education organizations that run Southsoft GMIS 5.0 for graduate or student administration. It is especially relevant where the system stores student photos. It is only a risk if an attacker can get a logged-in GMIS user to follow or open a malicious request.

How urgent is it

Public proof-of-concept attack code is available, so this deserves timely attention. It is not listed in CISA’s catalog of vulnerabilities known to be exploited, and the attack requires a user to interact with a malicious link; treat this as an amber-priority issue while you seek vendor guidance.

What to do — in detail

Verify the deployed application and version from the GMIS administration interface, installation records, or vendor support contract; scope systems running Southsoft GMIS 5.0.
Review whether authenticated users can reach the student-photo function and whether GMIS is accessible from the public internet, partner networks, or unmanaged devices.
There is no published fixed version or patch information. Contact Southsoft or your GMIS support provider for a supported remediation, advisory, or upgrade path before making product changes.
If patching is delayed, limit GMIS access to trusted networks or VPN users where operationally feasible, minimize unnecessary accounts, and warn users not to follow unexpected links while logged in.
Monitor web and application logs for unusual requests to student-photo pages, especially rapid changes to student identifiers or access patterns inconsistent with a user’s role. CISA has not assigned a KEV remediation due date because this CVE is not in KEV.

Technical context

CVSS v3.1 is 8.8 (High): AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The reported weakness is CWE-352, cross-site request forgery (CSRF), with user interaction required and no attacker privileges required. Public PoC material is available on GitHub (2 known). CISA KEV does not list this CVE, so there is no confirmed KEV exploitation signal or KEV due date. EPSS estimates 0.6% likelihood (48th percentile) and is flat; this is predictive, not evidence of exploitation. Press attention is rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS48th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 48th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 1673 days, from the signal feeds we watch.

2026-03-06Public exploit / PoCsource: github-poc
2024-11-21Record updated
2021-08-06Publishedweakness classified, att&ck mapped

Affected products

southsoftcommercial
- graduate management information systemEnterprise Software / itsm-monitoring

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable