CVE-2021-33981

Published: Sep 8, 2021Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people's personal information and images of their hunting/fishing licenses.

Affected (1)

Products: Myfwc: Fish | Hunt Fl

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Myfwc Fish \| Hunt Fl	Up to 3.8.0

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://gist.github.com/p4lsec/1f024d96b44ea733cdae0605c7ce8a49

Source: cve@mitre.org

Third Party Advisory

https://gist.github.com/p4lsec/1f024d96b44ea733cdae0605c7ce8a49

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.