CVE-2021-32096

2021-05-0704:15:07

Google

osv.dev

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.1%

JSON

The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter.

CPENameOperatorVersion
emissaryeq5.7.0
emissaryeq5.6.0
emissaryeq5.1.0
emissaryeq5.8.0
emissaryeq5.2.0
emissaryeq5.3.0
emissaryeq5.9.0
emissaryeq5.4.1
emissaryeq5.0.0
emissaryeq5.5.0

Name	Operator	Version
emissary	eq	5.7.0
emissary	eq	5.6.0
emissary	eq	5.1.0
emissary	eq	5.8.0
emissary	eq	5.2.0
emissary	eq	5.3.0
emissary	eq	5.9.0
emissary	eq	5.4.1
emissary	eq	5.0.0
emissary	eq	5.5.0