VulnerabilityModified

CVE-2021-42550

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

MEDIUM 6.6EPSS 4.44%

Does this matter?

Lower severity and a low EPSS score (4.44%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 6.6 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 4.44% probability · 91th percentile
CISA KEV: Not listed
Weakness: CWE-502
Affected: qos/logback · redhat/satellite · netapp/cloud manager · netapp/service level manager · netapp/snap creator framework · siemens/sinec nms
Source: vulnerability@ncsc.ch

References

http://logback.qos.ch/news.htmlVendor Advisory
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Jul/11Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdfThird Party Advisory
https://github.com/cn-panda/logbackRceDemoExploit, Third Party Advisory
https://jira.qos.ch/browse/LOGBACK-1591Exploit, Issue Tracking, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20211229-0001/Third Party Advisory
http://logback.qos.ch/news.htmlVendor Advisory
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Jul/11Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdfThird Party Advisory
https://github.com/cn-panda/logbackRceDemoExploit, Third Party Advisory
https://jira.qos.ch/browse/LOGBACK-1591Exploit, Issue Tracking, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20211229-0001/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.