CVE-2021-23418

2021-07-2900:00:00

ubuntu.com

glances package

3.2.1 version

xml external entity injection

fault

untrusted xml data

xml attacks

unix

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.019

Percentile

88.7%

JSON

The package glances before 3.2.1 are vulnerable to XML External Entity
(XXE) Injection via the use of Fault to parse untrusted XML data, which is
known to be vulnerable to XML attacks.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchglances< 2.11.1-3ubuntu0.1~esm1UNKNOWN
ubuntu20.04noarchglances< 3.1.3-1ubuntu0.1~esm1UNKNOWN
ubuntu16.04noarchglances< 2.3-1ubuntu0.1~esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	glances	< 2.11.1-3ubuntu0.1~esm1	UNKNOWN
ubuntu	20.04	noarch	glances	< 3.1.3-1ubuntu0.1~esm1	UNKNOWN
ubuntu	16.04	noarch	glances	< 2.3-1ubuntu0.1~esm1	UNKNOWN