CVE-2011-4356

2011-12-0511:55:07

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.5

Confidence

Low

EPSS

Percentile

5.1%

JSON

Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.

Affected configurations

Nvd

Node

celeryprojectceleryMatch2.1.0

celeryprojectceleryMatch2.2.0

celeryprojectceleryMatch2.2.1

celeryprojectceleryMatch2.2.2

celeryprojectceleryMatch2.2.3

celeryprojectceleryMatch2.2.4

celeryprojectceleryMatch2.2.5

celeryprojectceleryMatch2.2.6

celeryprojectceleryMatch2.2.7

celeryprojectceleryMatch2.3.0

celeryprojectceleryMatch2.3.1

celeryprojectceleryMatch2.3.2

celeryprojectceleryMatch2.3.3

celeryprojectceleryMatch2.4.0

celeryprojectceleryMatch2.4.1

celeryprojectceleryMatch2.4.2

celeryprojectceleryMatch2.4.3

VendorProductVersionCPE
celeryprojectcelery2.1.0cpe:2.3:a:celeryproject:celery:2.1.0:*:*:*:*:*:*:*
celeryprojectcelery2.2.0cpe:2.3:a:celeryproject:celery:2.2.0:*:*:*:*:*:*:*
celeryprojectcelery2.2.1cpe:2.3:a:celeryproject:celery:2.2.1:*:*:*:*:*:*:*
celeryprojectcelery2.2.2cpe:2.3:a:celeryproject:celery:2.2.2:*:*:*:*:*:*:*
celeryprojectcelery2.2.3cpe:2.3:a:celeryproject:celery:2.2.3:*:*:*:*:*:*:*
celeryprojectcelery2.2.4cpe:2.3:a:celeryproject:celery:2.2.4:*:*:*:*:*:*:*
celeryprojectcelery2.2.5cpe:2.3:a:celeryproject:celery:2.2.5:*:*:*:*:*:*:*
celeryprojectcelery2.2.6cpe:2.3:a:celeryproject:celery:2.2.6:*:*:*:*:*:*:*
celeryprojectcelery2.2.7cpe:2.3:a:celeryproject:celery:2.2.7:*:*:*:*:*:*:*
celeryprojectcelery2.3.0cpe:2.3:a:celeryproject:celery:2.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
celeryproject	celery	2.1.0	cpe:2.3:a:celeryproject:celery:2.1.0:::::::*
celeryproject	celery	2.2.0	cpe:2.3:a:celeryproject:celery:2.2.0:::::::*
celeryproject	celery	2.2.1	cpe:2.3:a:celeryproject:celery:2.2.1:::::::*
celeryproject	celery	2.2.2	cpe:2.3:a:celeryproject:celery:2.2.2:::::::*
celeryproject	celery	2.2.3	cpe:2.3:a:celeryproject:celery:2.2.3:::::::*
celeryproject	celery	2.2.4	cpe:2.3:a:celeryproject:celery:2.2.4:::::::*
celeryproject	celery	2.2.5	cpe:2.3:a:celeryproject:celery:2.2.5:::::::*
celeryproject	celery	2.2.6	cpe:2.3:a:celeryproject:celery:2.2.6:::::::*
celeryproject	celery	2.2.7	cpe:2.3:a:celeryproject:celery:2.2.7:::::::*
celeryproject	celery	2.3.0	cpe:2.3:a:celeryproject:celery:2.3.0:::::::*