CVE-2021-42559

Опубликовано: 12 янв. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted.

Ссылки

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42559-Command%20Injection%20Via%20Configurations-MITRE%20Caldera
Exploit
Third Party Advisory
https://github.com/mitre/caldera/releases
Release Notes
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42559-Command%20Injection%20Via%20Configurations-MITRE%20Caldera
Exploit
Third Party Advisory
https://github.com/mitre/caldera/releases
Release Notes

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mitre:caldera:*:*:*:*:*:*:*:*

Версия до 2.8.1 (включая)

EPSS

Процентиль: 88%

0.04005

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-77

Связанные уязвимости

GHSA-vmx9-qv3g-pj44

github

около 4 лет назад