CVE-2021-3621

HIGH

8.8

Descripcion

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado12/23/2021

Ultima modificacion11/3/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

fedoraproject:fedorafedoraproject:sssdredhat:enterprise_linuxredhat:enterprise_linux_eusredhat:enterprise_linux_server_ausredhat:enterprise_linux_server_tusredhat:virtualizationredhat:virtualization_host

Debilidades (CWE)

CWE-77CWE-78

Referencias

https://bugzilla.redhat.com/show_bug.cgi?id=1975142(secalert@redhat.com)

https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html(secalert@redhat.com)

https://sssd.io/release-notes/sssd-2.6.0.html(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=1975142(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2025/02/msg00008.html(af854a3a-2127-422b-91ae-364da2661108)

https://sssd.io/release-notes/sssd-2.6.0.html(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.