CVE-2021-42853

· CRITICALModified

← All CVEs

CVSS v3.1

9.1

EPSS

1.57%

Published

Mar 10, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerability at the "/api/appInternals/1.0/agent/diagnostic/logs" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be injected.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weaknesses (CWE)

CWE-20CWE-22

Affected Products (3)

riverbed · steelcentral_appinternals_dynamic_sampling_agent (up to 11.8.8)vulnerable

riverbed · steelcentral_appinternals_dynamic_sampling_agent (up to 12.13.0)vulnerable

riverbed · steelcentral_appinternals_dynamic_sampling_agentvulnerable

References (2)

https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Delete-Read-at-AgentDiagnosticServlet-CVE-2021-42853

Third Party Advisory

https://aternity.force.com/customersuccess/s/article/Directory-Traversal-Delete-Read-at-AgentDiagnosticServlet-CVE-2021-42853

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs