CVE-2021-42550

Katalog CVE

CVSS 6.6 · Medium EPSS 4,8%

Kerentanan Deserialization of Untrusted Data pada qos logback, redhat satellite +4 lainnya. Skor CVSS 3.1 6.6 (Medium) menurut NVD.

Deskripsi (NVD)

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

Rincian

Terbit di NVD

16 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.6 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

4,8% peluang dieksploitasi; lebih tinggi dari 91,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://logback.qos.ch/news.html advisory vendor
• https://jira.qos.ch/browse/LOGBACK-1591 exploit · issue tracking · patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injecti... exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2022/Jul/11 mailing list · advisory pihak ketiga
• https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf advisory pihak ketiga
• https://github.com/cn-panda/logbackRceDemo exploit · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211229-0001/ advisory pihak ketiga