Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:44270
HistoryNov 15, 2023 - 6:55 a.m.

Remote Code Execution (RCE)

2023-11-1506:55:45
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
3
vantage6_node
remote code execution
lack of validation
child task execution
unauthorized access
security checks
non-whitelisted algorithms

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

25.8%

vantage6_node is vulnerable to Remote Code Execution (RCE). The system fails to validate the execution of a child task if it has a specified parent task ID which could be exploited by an attacker who gains unauthorized access to the system. By setting a fake parent task ID for a malicious task, the attacker is able to bypass the usual security checks and execute the task without restriction. The parent task ID effectively circumvents the validation process, allowing the execution of non-whitelisted algorithms.

CPENameOperatorVersion
vantage6-nodele4.1.1
vantage6-nodele4.1.1

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

25.8%

Related for VERACODE:44270