CVE-2021-42559

Description

An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted.

CVSS Version 3.1

nvd

CVE ID: CVE-2021-42559
Base Score: 8.8
Base Severity: HIGH
Vector String:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 2.8

CVSS Version 2.0

nvd

CVE ID: CVE-2021-42559
Base Score: 6.5
Base Severity: MEDIUM
Vector String:AV:N/AC:L/Au:S/C:P/I:P/A:P

Proof Of Concept

mbadanoiu

CVE-2021-42559: Command Injection via Configurations in MITRE Caldera

Refrence: GitHub

Refrence: NVD