Lucene search

GitHub_MCVELIST:CVE-2021-32834

HistorySep 09, 2021 - 1:50 a.m.

CVE-2021-32834 Arbitrary Groovy script evaluation in Eclipse Keti

2021-09-0901:50:10

CWE-94

GitHub_M

www.cve.org

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.1%

JSON

Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.

CNA Affected

[
  {
    "product": "keti",
    "vendor": "eclipse",
    "versions": [
      {
        "status": "affected",
        "version": "<= a1c8dbe"
      }
    ]
  }
]

References

securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.1%

JSON

Related for CVELIST:CVE-2021-32834