CVE-2021-23727

Katalog CVE

CVSS 7.5 · High EPSS 3,9%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada celeryproject celery, fedoraproject extra packages for enterprise linux +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Rincian

Terbit di NVD

29 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

3,9% peluang dieksploitasi; lebih tinggi dari 89,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/celery/celery/blob/master/Changelog.rst%23522 broken link · release notes · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953 exploit · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWM...