CVE-2021-42550

Опубликовано: 16 дек. 2021

Источник: nvd

CVSS3: 6.6

CVSS2: 8.5

EPSS Низкий

Описание

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

Ссылки

http://logback.qos.ch/news.html
Vendor Advisory
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2022/Jul/11
Mailing List
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf
Third Party Advisory
https://github.com/cn-panda/logbackRceDemo
Exploit
Third Party Advisory
https://jira.qos.ch/browse/LOGBACK-1591
Exploit
Issue Tracking
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211229-0001/
Third Party Advisory
http://logback.qos.ch/news.html
Vendor Advisory
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2022/Jul/11
Mailing List
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf
Third Party Advisory
https://github.com/cn-panda/logbackRceDemo
Exploit
Third Party Advisory
https://jira.qos.ch/browse/LOGBACK-1591
Exploit
Issue Tracking
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211229-0001/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:qos:logback:*:*:*:*:*:*:*:*

Версия до 1.2.7 (включая)

cpe:2.3:a:qos:logback:1.3.0:alpha0:*:*:*:*:*:*

cpe:2.3:a:qos:logback:1.3.0:alpha1:*:*:*:*:*:*

cpe:2.3:a:qos:logback:1.3.0:alpha10:*:*:*:*:*:*

cpe:2.3:a:qos:logback:1.3.0:alpha2:*:*:*:*:*:*

cpe:2.3:a:qos:logback:1.3.0:alpha3:*:*:*:*:*:*

cpe:2.3:a:qos:logback:1.3.0:alpha4:*:*:*:*:*:*

cpe:2.3:a:qos:logback:1.3.0:alpha5:*:*:*:*:*:*

cpe:2.3:a:qos:logback:1.3.0:alpha6:*:*:*:*:*:*

cpe:2.3:a:qos:logback:1.3.0:alpha7:*:*:*:*:*:*

cpe:2.3:a:qos:logback:1.3.0:alpha8:*:*:*:*:*:*

cpe:2.3:a:qos:logback:1.3.0:alpha9:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*

Версия до 1.0.3 (исключая)

EPSS

Процентиль: 85%

0.02604

Низкий

6.6 Medium

CVSS3

8.5 High

CVSS2

Дефекты

CWE-502

Связанные уязвимости

CVE-2021-42550

CVSS3: 6.6

ubuntu

около 4 лет назад

CVE-2021-42550

CVSS3: 6.6

redhat

около 4 лет назад

CVE-2021-42550

CVSS3: 6.6

debian

около 4 лет назад

In logback version 1.2.7 and prior versions, an attacker with the requ ...

SUSE-SU-2023:2097-1

suse-cvrf

почти 3 года назад

Security update for maven and recommended update for antlr3, minlog, sbt, xmvn

GHSA-668q-qrv7-99fm

CVSS3: 6.6

github

около 4 лет назад

Deserialization of Untrusted Data in logback

EPSS

Процентиль: 85%

0.02604

Низкий

6.6 Medium

CVSS3

8.5 High

CVSS2

Дефекты

CWE-502