CVE-2021-3621

2021-12-2300:00:00

CWE-77

redhat

www.cve.org

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.7%

JSON

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "sssd",
    "versions": [
      {
        "version": "sssd 2.6.0",
        "status": "affected"
      }
    ]
  }
]