Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

CVE-2021-32834

Published

2 years ago

Last Modified

1 year ago

CVSSv2.0 Severity

Medium

CVSSv3.1 Severity

Critical

Impact Analysis

Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063..

CVSSv2.0 Score

Severity: Medium
Base Score: 6.5/10
Exploit Score: 8/10
Access Vector: Network
Access Complexity: Low
Authentication Required: Single
Impact Score: 6.4/10
Confidentiality Impact: Partial
Availability Impact: Partial
Integrity Impact: Partial

CVSSv3.1 Score

Severity: Critical
Base Score: 9.9/10
Exploit Score: 3.1/10
Access Vector: Network
Access Complexity: Low
Privileges Required: Low
Impact Score: 6/10
Confidentiality Impact: High
Availability Impact: High
Integrity Impact: High
Scope: Changed
User Interaction: None

Products Affected

CPE	Affected	Vulnerable	Excluding	Edit
cpe:2.3:a:eclipse:keti:-:::::::*	Yes	-	-

References

https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/