CVE-2021-3560

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 23,7%

Kerentanan Incorrect Authorization pada polkit project polkit, debian linux +4 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 12 Mei 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Rincian

Terbit di NVD

16 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization
CWE-754: Improper Check for Unusual or Exceptional Conditions

EPSS (30 hari)

23,7% peluang dieksploitasi; lebih tinggi dari 97,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Red Hat Polkit Incorrect Authorization Vulnerability

Masuk KEV

12 Mei 2023

Tenggat CISA

2 Juni 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1961710 issue tracking · patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3560 pemerintah AS
• http://packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.html advisory pihak ketiga · vdb entry
• https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/ exploit · advisory pihak ketiga