Security readout for executives and security teams
Plain-English summary
Planview Spigit 4.5.3 reportedly exposes sensitive user account data through its REST API without authentication. For an organization using this version, the business risk is disclosure of user information to remote outsiders if the API is reachable. The public record does not provide CVSS scoring, a vendor fix, or evidence of active exploitation.
Executive priority
Treat as a near-term exposure review for any organization using Planview Spigit. Prioritize confirming whether Spigit 4.5.3 exists and whether its API is internet-accessible, because the reported impact is unauthorized disclosure of sensitive user account data.
Technical view
CVE-2021-38095 describes unauthenticated remote access to sensitive user account data in the REST API of Planview Spigit 4.5.3. The CVE description cites a simple user lookup as the demonstration case, and a public GitHub proof-of-concept is referenced. No CWE, CVSS vector, affected-version range beyond 4.5.3, or patch details are provided.
Likely exposure
Exposure is most likely where Planview Spigit 4.5.3 is deployed and its REST API is reachable from untrusted networks. The source bundle does not establish whether other versions are affected.
Exploitation context
A public proof-of-concept repository is listed, so the issue is publicly documented. CISA KEV status is false in the bundle, and no cited source states active exploitation in the wild.
Researcher notes
The public data is thin: no CVSS, CWE, patch statement, or affected-version range is supplied. Analysis should stay scoped to Planview Spigit 4.5.3 unless vendor guidance or further evidence expands impact.
Mitigation direction
- Identify any Planview Spigit deployments and confirm whether version 4.5.3 is present.
- Restrict REST API access to trusted networks or authenticated users where possible.
- Contact Planview for supported fixed-version or configuration guidance.
- Review access logs for unauthenticated user-account data requests.
- Reduce internet exposure with VPN, allowlisting, or WAF controls until vendor guidance is applied.
Validation and detection
- Inventory public and internal Spigit URLs and owners.
- Verify deployed versions; do not assume versions beyond 4.5.3 are affected.
- Confirm the REST API does not return user account data anonymously.
- Review application and web logs for suspicious anonymous API enumeration.
- Record evidence, compensating controls, and remediation status in vulnerability tracking.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-38095 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.planview.com/products-solutions/products/spigit/CVE reference · x_refsource_MISC
- https://github.com/FlaviuPopescu/Spigit-PoCCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.