CVE-2021-42550

Published: Dic 16, 2021 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2021-2454 Aliases: GHSA-668q-qrv7-99fm
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,6
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
HIGH 8,5
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: single
Confidentiality: complete
Integrity: complete
Availability: complete

Description

AI Translation Available

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0260
Percentile
0,9th
Updated

EPSS Score Trend (Last 90 Days)

502

Deserialization of Untrusted Data

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Application Data Unexpected State Dos: Resource Consumption (Cpu) Varies By Context
Applicable Platforms
Languages: Java, JavaScript, PHP, Python, Ruby
Technologies: AI/ML, ICS/OT, Not Technology-Specific
Likelihood of Exploit: Medium
View CWE Details
Application

Cloud Manager by Netapp

Product Information
Vendor Netapp
Product Cloud Manager
Version -
cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha4:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha6:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha5:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha8:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha9:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha10:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Service Level Manager by Netapp

Product Information
Vendor Netapp
Product Service Level Manager
Version -
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha7:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Satellite by Redhat

Product Information
Vendor Redhat
Product Satellite
Version 6.0
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version Range Affected
To 1.2.7 (inclusive)
cpe:2.3:a:qos:logback:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha0:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Snap Creator Framework by Netapp

Product Information
Vendor Netapp
Product Snap Creator Framework
Version -
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Sinec Nms by Siemens

Product Information
Vendor Siemens
Product Sinec Nms
Version Range Affected
To 1.0.3 (exclusive)
cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Logback by Qos

Product Information
Vendor Qos
Product Logback
Version 1.3.0
cpe:2.3:a:qos:logback:1.3.0:alpha3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
http://logback.qos.ch/news.html
Vendor Advisory
http://logback.qos.ch/news.html
http://packetstormsecurity.com/files/167794/Open-Xchange-Ap…
Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross…
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.…
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf
http://seclists.org/fulldisclosure/2022/Jul/11
Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jul/11
https://github.com/cn-panda/logbackRceDemo
Exploit Third Party Advisory
https://github.com/cn-panda/logbackRceDemo
https://jira.qos.ch/browse/LOGBACK-1591
Exploit Issue Tracking Patch Third Party Advisory
https://jira.qos.ch/browse/LOGBACK-1591
https://security.netapp.com/advisory/ntap-20211229-0001/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211229-0001/
http://logback.qos.ch/news.html
Vendor Advisory
http://logback.qos.ch/news.html
http://packetstormsecurity.com/files/167794/Open-Xchange-Ap…
Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross…
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.…
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf
http://seclists.org/fulldisclosure/2022/Jul/11
Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jul/11
https://github.com/cn-panda/logbackRceDemo
Exploit Third Party Advisory
https://github.com/cn-panda/logbackRceDemo
https://jira.qos.ch/browse/LOGBACK-1591
Exploit Issue Tracking Patch Third Party Advisory
https://jira.qos.ch/browse/LOGBACK-1591
https://security.netapp.com/advisory/ntap-20211229-0001/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211229-0001/