Lucene search

MitreCVE-2021-26758

HistoryApr 07, 2021 - 9:15 p.m.

CVE-2021-26758

2021-04-0721:15:16

CWE-269

mitre

web.nvd.nist.gov

cve-2021-26758

openlitespeed

privilege escalation

web server

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.153

Percentile

96.0%

JSON

Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system.

Affected configurations

Nvd

Node

litespeedtechopenlitespeedMatch1.7.8

VendorProductVersionCPE
litespeedtechopenlitespeed1.7.8cpe:2.3:a:litespeedtech:openlitespeed:1.7.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
litespeedtech	openlitespeed	1.7.8	cpe:2.3:a:litespeedtech:openlitespeed:1.7.8:::::::*

References

docs.unsafe-inline.com/0day/openlitespeed-web-server-1.7.8-command-injection-to-privilege-escalation-cve-2021-26758

github.com/litespeedtech/openlitespeed/issues/217

www.exploit-db.com/exploits/49556

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.153

Percentile

96.0%

JSON

Related for CVE-2021-26758