Lucene search

Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-6E34C2BEA3CA497A28E91F2130A74645

HistoryJun 22, 2021 - 12:00 a.m.

Missing Authentication for Critical Function

2021-06-2200:00:00

https://gitlab.com/gitlab-org/security-products/gemnasium-db

gitlab.com

authentication

vulnerability

attacker

malicious code

ballerina executables

security document

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

31.6%

JSON

The vulnerability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code into ballerina executables.

Affected configurations

Vulners

Node

mavenballerina-langRange<1.2.14

VendorProductVersionCPE
mavenballerina-lang*cpe:2.3:a:maven:ballerina-lang:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
maven	ballerina-lang	*	cpe:2.3:a:maven:ballerina-lang::::::::

References

nvd.nist.gov/vuln/detail/CVE-2021-32700

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

31.6%

JSON

Related for GITLAB-6E34C2BEA3CA497A28E91F2130A74645