CVE-2021-42559

An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.96% chance of exploitation in the next 30 days, 79th percentile

Published

2022-01-12

Updated

2024-08-04

Proof-of-concept exploits (2)

• DrunkenShells/Disclosures/tree/master/CVE-2021-42559-Command%20Injection%20Via%20Configur…
• mbadanoiu/CVE-2021-425590★ · 2024-06-09

References

• CVE Record
• NVD entry

Related

• CVE-2019-10092
• CVE-2019-11287
• CVE-2019-12401
• CVE-2019-12409
• CVE-2019-1332
• CVE-2019-14678