CVE-2021-42550

🗓️ 16 Dec 2021 00:00:00Reported by NCSC.chType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 304 Views

Logback 1.2.7 and earlier allows arbitrary code execution via crafted configuration file

Reporter	Title	Published	Views	Family All 64
IBM Security Bulletins	Security Bulletin: A vulnerability in logback-classic affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2021-42550)	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities in Node.js (CVE-2022-43548, CVE-2020-7676, CVE-2021-42550, CVE-2021-38561, CVE-2022-32149)	22 Jun 202320:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Open Source software used by Cloud Pak System	31 Mar 202314:10	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities in mas-data-dictionary-lib-1.0.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2022-1471, CVE-2023-1370 and CVE-2021-42550)	15 Jan 202418:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Logback	23 Feb 202217:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in IBM Db2, Golang Go, and Logback may affect the IBM Spectrum Protect Server (CVE-2022-30631, CVE-2022-30633, CVE-2022-1705, CVE-2022-22389, CVE-2022-22390, CVE-2021-42550, CVE-2022-30629)	17 Sep 202202:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found with third-party libraries used by IBM® MobileFirst Platform	17 Feb 202315:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilties (CVE-2022-43548, CVE-2020-7676, CVE-2021-42550, CVE-2021-38561, CVE-2022-32149)	17 Mar 202317:13	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in Asset Data Dictionary used by IBM Maximo Asset Management application (CVE-2023-44487, CVE-2022-41881, CVE-2022-41915, CVE-2021-42550, CVE-2023-34462, CVE-2023-6481 and CVE-2023-6378)	29 Feb 202413:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Scale Transparent Cloud Tiering is affected by a vulnerability which can allow an attacker to execute arbitrary code	26 Jun 202304:56	–	ibm

NVD

Node

qos logbackRange≤1.2.7

qos logbackMatch1.3.0alpha0

qos logbackMatch1.3.0alpha1

qos logbackMatch1.3.0alpha10

qos logbackMatch1.3.0alpha2

qos logbackMatch1.3.0alpha3

qos logbackMatch1.3.0alpha4

qos logbackMatch1.3.0alpha5

qos logbackMatch1.3.0alpha6

qos logbackMatch1.3.0alpha7

qos logbackMatch1.3.0alpha8

qos logbackMatch1.3.0alpha9

Node

redhat satelliteMatch6.0

Node

netapp cloud_managerMatch-

netapp service_level_managerMatch-

netapp snap_creator_frameworkMatch-

Node

siemens sinec_nmsRange<1.0.3

[
  {
    "vendor": "QOS.ch",
    "product": "logback",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "1.2.9",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "1.3.0-alpha11",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
security	www.security.netapp.com/advisory/ntap-20211229-0001/
jira	www.jira.qos.ch/browse/LOGBACK-1591
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf
logback	www.logback.qos.ch/news.html
packetstormsecurity	www.packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
seclists	www.seclists.org/fulldisclosure/2022/Jul/11
github	www.github.com/cn-panda/logbackRceDemo

21 Nov 2024 06:27Current

7High risk

Vulners AI Score7

CVSS 3.16.6

CVSS 28.5

EPSS0.02729

CWE-502