Security readout for executives and security teams
Plain-English summary
CVE-2021-22857 is a high-severity file disclosure flaw in ChanGate EnterPrise Co., Ltd property management system. A vulnerable download function can let an unauthenticated remote attacker retrieve system files. The main business risk is exposure of sensitive files, credentials, configuration data, or personal information stored on the server.
Executive priority
High priority for any internet-facing deployment. The issue is confidentiality-focused, easy to exploit according to CVSS, and could expose sensitive operational or personal data. Prioritize discovery, vendor fix confirmation, and access restriction while evidence on exact affected versions remains limited.
Technical view
The CGE page download function has a CWE-22 directory traversal vulnerability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning remote, low-complexity, unauthenticated exploitation with high confidentiality impact and no cited integrity or availability impact.
Likely exposure
Exposure is likely limited to organizations running ChanGate EnterPrise Co., Ltd property management system where the CGE download page is reachable over a network. The source bundle does not provide clear affected version ranges beyond the listed affected version value, so owners should confirm applicability with the vendor or maintainer.
Exploitation context
The sources describe arbitrary system file download through directory traversal. KEV status is false, and the provided sources do not confirm active exploitation, public exploit availability, or weaponized campaigns. Treat internet-exposed systems as higher priority because CVSS indicates no authentication or user interaction is required.
Researcher notes
Evidence is concise and vendor/version detail is limited. The key observable is a directory traversal flaw in a CGE download function causing arbitrary system file download. Do not assume affected products beyond the named ChanGate EnterPrise property management system, and do not claim active exploitation from the provided bundle.
Mitigation direction
- Check ChanGate, TWCERT, and CHT Security guidance for supported fixes or patches.
- Restrict external access to the property management system and CGE download page.
- Disable the affected download function until vendor remediation is confirmed, if operationally feasible.
- Limit web server file permissions to reduce sensitive file exposure.
- Monitor application and web logs for suspicious file download activity.
Validation and detection
- Inventory deployments of ChanGate EnterPrise property management system.
- Confirm whether the CGE download function is enabled and network reachable.
- Verify product version and patch status with vendor or system owner records.
- Review logs for abnormal download requests or sensitive file access attempts.
- Assess whether exposed files could contain credentials or regulated data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-22857 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.twcert.org.tw/tw/cp-132-4395-c01f7-1.htmlCVE reference · x_refsource_MISC
- https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.