CVE-2021-36667

Опубликовано: 12 июл. 2022

Источник: nvd

CVSS3: 7.8

CVSS2: 4.6

EPSS Низкий

Описание

Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library.

Ссылки

http://druva.com
Product
https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_before
Patch
Vendor Advisory
https://imhotepisinvisible.com/druva-lpe/
Exploit
Patch
Technical Description
Third Party Advisory
http://druva.com
Product
https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_before
Patch
Vendor Advisory
https://imhotepisinvisible.com/druva-lpe/
Exploit
Patch
Technical Description
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:druva:insync_client:*:*:*:*:*:macos:*:*

Версия до 7.0.0 (исключая)

EPSS

Процентиль: 77%

0.01071

Низкий

7.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-gjvp-gq3c-wh68