CVE-2021-42559

An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted.

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.96% chance of exploitation in the next 30 days, 80th percentile

Published

2022-01-12

Updated

2024-08-04

Proof-of-concept exploits (2)

• DrunkenShells/Disclosures/tree/master/CVE-2021-42559-Command%20Injection%20Via%20Configur…92★ · 2022-02-13
• mbadanoiu/CVE-2021-425590★ · 2024-06-09

Security advisories

• mitre/caldera/releases

References

• CVE Record
• NVD entry

Related

• CVE-2019-10092
• CVE-2019-11287
• CVE-2019-12401
• CVE-2019-12409
• CVE-2019-1332
• CVE-2019-14678