CVE-2021-32849 Arbitrary command execution in Gerapy

2022-01-2621:30:14

CWE-78

GitHub_M

www.cve.org

gerapy

distributed crawler

command execution

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.041

Percentile

92.3%

JSON

Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.

CNA Affected

[
  {
    "product": "gerapy",
    "vendor": "Gerapy",
    "versions": [
      {
        "lessThan": "0.9.9",
        "status": "affected",
        "version": "0.9.9",
        "versionType": "custom"
      }
    ]
  }
]