4.3

CVE-2021-28938

Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x before 7.6.2-20.2, 7.7.x through 7.9.x before 7.9.3-21.6, 7.10.x before 7.10.2-22.2, and 7.11.x before 7.11.2-23.0 can leak user information across thread contexts. This occurs in opportunistic circumstances when there is concurrent query execution by a low-privilege user and a high-privilege user. The former query might run with the latter query's privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siren ≫ Federate SwPlatformelasticsearch Version < 6.8.14-10.3.9
Siren ≫ Federate SwPlatformelasticsearch Version >= 7.3.2-19.0 < 7.6.2-20.2
Siren ≫ Federate SwPlatformelasticsearch Version >= 7.7.1-20.0 < 7.9.3-21.6
Siren ≫ Federate SwPlatformelasticsearch Version >= 7.10.1-22.0 < 7.10.2-22.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.595
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.