CVE-2021-23154

Description

In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to run on the system.

CVSS Version 3.1

nvd

CVE ID: CVE-2021-23154
Base Score: 7.8
Base Severity: HIGH
Vector String:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 1.8

mirantis

CVE ID: CVE-2021-23154
Base Score: 6.3
Base Severity: MEDIUM
Vector String:CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 0.3

CVSS Version 2.0

nvd

CVE ID: CVE-2021-23154
Base Score: 9.3
Base Severity: HIGH
Vector String:AV:N/AC:M/Au:N/C:C/I:C/A:C

Refrence: NVDMITRE