Lucene search

GitHub_MCVE-2021-32849

HistoryJan 26, 2022 - 10:15 p.m.

CVE-2021-32849

2022-01-2622:15:07

CWE-78

CWE-77

GitHub_M

web.nvd.nist.gov

gerapy

cve-2021-32849

distributed crawler

management framework

security

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.041

Percentile

92.3%

JSON

Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.

Affected configurations

Nvd

Vulners

Node

gerapygerapyRange<0.9.9

VendorProductVersionCPE
gerapygerapy*cpe:2.3:a:gerapy:gerapy:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gerapy	gerapy	*	cpe:2.3:a:gerapy:gerapy::::::::

CNA Affected

[
  {
    "product": "gerapy",
    "vendor": "Gerapy",
    "versions": [
      {
        "lessThan": "0.9.9",
        "status": "affected",
        "version": "0.9.9",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/Gerapy/Gerapy/issues/197

github.com/Gerapy/Gerapy/issues/217

github.com/Gerapy/Gerapy/security/advisories/GHSA-756h-r2c9-qp5j

lgtm.com/projects/g/Gerapy/Gerapy?mode=tree&ruleFocus=1505994646253

securitylab.github.com/advisories/GHSL-2021-076-gerapy/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.041

Percentile

92.3%

JSON

Related for CVE-2021-32849