Lucene search

CVE-2021-3899

🗓️ 03 Jun 2024 19:08:15Reported by canonicalType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 1858 Views🌐 WEB

CVE-2021-3899 NVD security document

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 14
UbuntuCve	CVE-2021-3899	17 May 202200:00	–	ubuntucve
Veracode	Arbitrary Code Execution	18 May 202218:29	–	veracode
Cvelist	CVE-2021-3899	3 Jun 202418:40	–	cvelist
NVD	CVE-2021-3899	3 Jun 202419:15	–	nvd
Vulnrichment	CVE-2021-3899	3 Jun 202418:40	–	vulnrichment
GithubExploit	Exploit for CVE-2021-3899	21 May 202201:52	–	githubexploit
Tenable Nessus	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Apport vulnerabilities (USN-5427-1)	17 May 202200:00	–	nessus
Tenable Nessus	Ubuntu 16.04 LTS : Apport vulnerabilities (USN-6894-1)	12 Jul 202400:00	–	nessus
OpenVAS	Ubuntu: Security Advisory (USN-6894-1)	12 Jul 202400:00	–	openvas
OpenVAS	Ubuntu: Security Advisory (USN-5427-1)	18 May 202200:00	–	openvas

[
  {
    "packageName": "apport",
    "product": "Apport",
    "vendor": "Canonical Ltd.",
    "repo": "https://github.com/canonical/apport",
    "platforms": [
      "Linux"
    ],
    "versions": [
      {
        "lessThan": "2.21.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
cve	www.cve.org/CVERecord
ubuntu	www.ubuntu.com/security/notices/USN-5427-1
bugs	www.bugs.launchpad.net/ubuntu/+source/apport/+bug/1948376

Parameter	Position	Path	Description	CWE
ALL ALL=(root) NOPASSWD: /usr/bin/ping	request body	/etc/sudoers	Configuration allowing users to run ping as root without password, leading to potential local privilege escalation via Apport.	CWE-367
logrotate	request body	/etc/logrotate.conf	Logrotate configuration that is exploited to trigger a reverse shell process.	CWE-367
core	request body	/etc/logrotate.d/core	Core dump file location where the unauthorized access occurs after the exploitable race condition.	CWE-367

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

03 Jun 2024 19:15Current

7.2High risk

Vulners AI Score7.2

CVSS37.8

EPSS0.02429

SSVC

CWE-367