CVE-2021-22538

Katalog CVE

CVSS 8.8 · High EPSS 0,72%

Kerentanan Improper Input Validation pada google exposure notifications verification server. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event would be captured in the Event Log.

Rincian

Terbit di NVD

31 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-276: Incorrect Default Permissions

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/google/exposure-notifications-verification-server/commit/eb8cf40b12dbe79304f1133c06fb734193... patch · advisory pihak ketiga
• https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.23.1 release notes · advisory pihak ketiga
• https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.24.0 release notes · advisory pihak ketiga
• https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-5v95-v8c8-3rh6 advisory pihak ketiga