Lucene search

[email protected]NVD:CVE-2021-26758

HistoryApr 07, 2021 - 9:15 p.m.

CVE-2021-26758

2021-04-0721:15:16

CWE-269

[email protected]

web.nvd.nist.gov

privilege escalation

openlitespeed

web server

version 1.7.8

root terminal access

host system

execute commands

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.153

Percentile

96.0%

JSON

Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system.

Affected configurations

Nvd

Node

litespeedtechopenlitespeedMatch1.7.8

VendorProductVersionCPE
litespeedtechopenlitespeed1.7.8cpe:2.3:a:litespeedtech:openlitespeed:1.7.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
litespeedtech	openlitespeed	1.7.8	cpe:2.3:a:litespeedtech:openlitespeed:1.7.8:::::::*

References

docs.unsafe-inline.com/0day/openlitespeed-web-server-1.7.8-command-injection-to-privilege-escalation-cve-2021-26758

github.com/litespeedtech/openlitespeed/issues/217

www.exploit-db.com/exploits/49556

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.153

Percentile

96.0%

JSON

Related for NVD:CVE-2021-26758

osv1 cvelist1 prion1 cve1