Lucene search

[email protected]NVD:CVE-2021-21783

HistoryMar 25, 2021 - 5:15 p.m.

CVE-2021-21783

2021-03-2517:15:13

CWE-680

CWE-190

[email protected]

web.nvd.nist.gov

code execution

genivia gsoap 2.8.107

ws-addressing plugin

soap request

remote code execution

http request

vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.037

Percentile

91.9%

JSON

A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.

Affected configurations

Nvd

Node

geniviagsoapMatch2.8.107

Node

oraclecommunications_diameter_signaling_routerRange8.0.0–8.5.0

oraclecommunications_eagle_application_processorRange16.1.0–16.4.0

oraclecommunications_eagle_lnp_application_processorMatch46.7

oraclecommunications_eagle_lnp_application_processorMatch46.8

oraclecommunications_eagle_lnp_application_processorMatch46.9

oraclecommunications_lsmsMatch13.1

oraclecommunications_lsmsMatch13.2

oraclecommunications_lsmsMatch13.3

oraclecommunications_lsmsMatch13.4

oracletekelec_virtual_operating_environmentRange3.4.0–3.7.1

VendorProductVersionCPE
geniviagsoap2.8.107cpe:2.3:a:genivia:gsoap:2.8.107:*:*:*:*:*:*:*
oraclecommunications_diameter_signaling_router*cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
oraclecommunications_eagle_application_processor*cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*
oraclecommunications_eagle_lnp_application_processor46.7cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:46.7:*:*:*:*:*:*:*
oraclecommunications_eagle_lnp_application_processor46.8cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:46.8:*:*:*:*:*:*:*
oraclecommunications_eagle_lnp_application_processor46.9cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:46.9:*:*:*:*:*:*:*
oraclecommunications_lsms13.1cpe:2.3:a:oracle:communications_lsms:13.1:*:*:*:*:*:*:*
oraclecommunications_lsms13.2cpe:2.3:a:oracle:communications_lsms:13.2:*:*:*:*:*:*:*
oraclecommunications_lsms13.3cpe:2.3:a:oracle:communications_lsms:13.3:*:*:*:*:*:*:*
oraclecommunications_lsms13.4cpe:2.3:a:oracle:communications_lsms:13.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
genivia	gsoap	2.8.107	cpe:2.3:a:genivia:gsoap:2.8.107:::::::*
oracle	communications_diameter_signaling_router	*	cpe:2.3:a:oracle:communications_diameter_signaling_router::::::::
oracle	communications_eagle_application_processor	*	cpe:2.3:a:oracle:communications_eagle_application_processor::::::::
oracle	communications_eagle_lnp_application_processor	46.7	cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:46.7:::::::*
oracle	communications_eagle_lnp_application_processor	46.8	cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:46.8:::::::*
oracle	communications_eagle_lnp_application_processor	46.9	cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:46.9:::::::*
oracle	communications_lsms	13.1	cpe:2.3:a:oracle:communications_lsms:13.1:::::::*
oracle	communications_lsms	13.2	cpe:2.3:a:oracle:communications_lsms:13.2:::::::*
oracle	communications_lsms	13.3	cpe:2.3:a:oracle:communications_lsms:13.3:::::::*
oracle	communications_lsms	13.4	cpe:2.3:a:oracle:communications_lsms:13.4:::::::*