CVE-2021-41091

🗓️ 04 Oct 2021 20:20:09Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 279 Views🌐 WEB

Moby (Docker Engine) 20.10.9 fixed a bug allowing unprivileged Linux users to execute programs through insufficiently restricted permissions

Reporter	Title	Published	Views	Family All 118
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Docker affect IBM InfoSphere Information Server	14 Oct 202221:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to assorted vulnerabilities in Grafana	19 Jul 202421:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Files or Directories Accessible to External Parties in Grafana (CVE-2021-41089, CVE-2022-24769, CVE-2021-41091, CVE-2018-20699, CVE-2022-36109)	5 Aug 202419:51	–	ibm
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Mobyproject Moby	2 May 202307:25	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Docker	14 Feb 202604:10	–	githubexploit
GithubExploit	Exploit for Incorrect Permission Assignment for Critical Resource in Mobyproject Moby	30 Jun 202410:57	–	githubexploit
ATTACKERKB	CVE-2021-41091	4 Oct 202121:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : docker (ALAS-2022-017) (deprecated)	8 Mar 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2 : docker (ALASDOCKER-2022-017)	2 May 202200:00	–	nessus

NVD

Vulners

Node

mobyproject mobyRange<20.10.9

Node

fedoraproject fedoraMatch34

fedoraproject fedoraMatch35

[
  {
    "product": "moby",
    "vendor": "moby",
    "versions": [
      {
        "status": "affected",
        "version": "< 20.10.9"
      }
    ]
  }
]

Source	Link
github	www.github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
github	www.github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/

Parameter	Position	Path	Description	CWE
permissions	path	/var/lib/docker	Unprivileged users abusing permissive permissions in Docker data directory to traverse and execute files within containers.	CWE-281, CWE-732
owner	path	/var/lib/docker	Unprivileged users abusing permissive permissions in Docker data directory to traverse and execute files within containers.	CWE-281, CWE-732
group	path	/var/lib/docker	Unprivileged users abusing permissive permissions in Docker data directory to traverse and execute files within containers.	CWE-281, CWE-732
setuid bits	path	/var/lib/docker	Unprivileged users abusing permissive permissions in Docker data directory to traverse and execute files within containers.	CWE-281, CWE-732
permissions	path	/var/lib/docker/overlay2	Exploitation via overly permissive directory permissions in overlay2 enabling host traversal/execution.	CWE-281, CWE-732
owner	path	/var/lib/docker/overlay2	Exploitation via overly permissive directory permissions in overlay2 enabling host traversal/execution.	CWE-281, CWE-732
group	path	/var/lib/docker/overlay2	Exploitation via overly permissive directory permissions in overlay2 enabling host traversal/execution.	CWE-281, CWE-732
overlay filesystem access	path	/var/lib/docker/overlay2	Exploitation via overly permissive directory permissions in overlay2 enabling host traversal/execution.	CWE-281, CWE-732
setuid bit	path	/bin/bash	Setuid binary exploitation on host via containerized bash to escalate privileges.	CWE-281, CWE-732
chmod u+s	path	/bin/bash	Setuid binary exploitation on host via containerized bash to escalate privileges.	CWE-281, CWE-732

17 Jun 2026 04:07Current

6.9Medium risk

Vulners AI Score6.9

CVSS 24.6

CVSS 3.16.3

EPSS0.02693