CVE-2021-42559

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

1.96%

Published

Jan 12, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-77

Affected Products (1)

mitre · calderavulnerable

References (4)

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42559-Command%20Injection%20Via%20Configurations-MITRE%20Caldera

ExploitThird Party Advisory

https://github.com/mitre/caldera/releases

Release Notes

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42559-Command%20Injection%20Via%20Configurations-MITRE%20Caldera

ExploitThird Party Advisory

https://github.com/mitre/caldera/releases

Release Notes

KEV Catalog EPSS Scores Vendors All CVEs