Lucene search

CheckpointCVE-2021-30357

HistoryJun 08, 2021 - 2:15 p.m.

CVE-2021-30357

2021-06-0814:15:07

CWE-209

checkpoint

web.nvd.nist.gov

cve-2021-30357

ssl network extender

linux

configuration file

disclosure vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

28.5%

JSON

SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing files to which the user did not have access.

Affected configurations

Nvd

Node

checkpointssl_network_extenderMatchr80.10linux

checkpointssl_network_extenderMatchr80.20linux

checkpointssl_network_extenderMatchr80.30linux

checkpointssl_network_extenderMatchr80.40linux

checkpointssl_network_extenderMatchr81linux

VendorProductVersionCPE
checkpointssl_network_extenderr80.10cpe:2.3:a:checkpoint:ssl_network_extender:r80.10:*:*:*:*:linux:*:*
checkpointssl_network_extenderr80.20cpe:2.3:a:checkpoint:ssl_network_extender:r80.20:*:*:*:*:linux:*:*
checkpointssl_network_extenderr80.30cpe:2.3:a:checkpoint:ssl_network_extender:r80.30:*:*:*:*:linux:*:*
checkpointssl_network_extenderr80.40cpe:2.3:a:checkpoint:ssl_network_extender:r80.40:*:*:*:*:linux:*:*
checkpointssl_network_extenderr81cpe:2.3:a:checkpoint:ssl_network_extender:r81:*:*:*:*:linux:*:*

Vendor	Product	Version	CPE
checkpoint	ssl_network_extender	r80.10	cpe:2.3:a:checkpoint:ssl_network_extender:r80.10:::::linux::
checkpoint	ssl_network_extender	r80.20	cpe:2.3:a:checkpoint:ssl_network_extender:r80.20:::::linux::
checkpoint	ssl_network_extender	r80.30	cpe:2.3:a:checkpoint:ssl_network_extender:r80.30:::::linux::
checkpoint	ssl_network_extender	r80.40	cpe:2.3:a:checkpoint:ssl_network_extender:r80.40:::::linux::
checkpoint	ssl_network_extender	r81	cpe:2.3:a:checkpoint:ssl_network_extender:r81:::::linux::

CNA Affected

[
  {
    "product": "SSL Network Extender Client for Linux",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "before build 800008302"
      }
    ]
  }
]

References

supportcontent.checkpoint.com/solutions?id=sk173513

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

28.5%

JSON

Related for CVE-2021-30357