9.6
CVE-2021-44458
- EPSS 0.43%
- Veröffentlicht 10.01.2022 16:15:09
- Zuletzt bearbeitet 21.11.2024 06:31:01
- Quelle psirt@mirantis.com
- CVE-Watchlists
- Unerledigt
LoginLack of websocket authentication in Lens causes remote code execution when visiting a malicious website
Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from the victim's browser to Lens and so operate the local terminal feature. This would allow the attacker to execute arbitrary commands as the Lens user.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.43% | 0.343 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.6 | 2.8 | 6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
|
| nvd@nist.gov | 5.1 | 4.9 | 6.4 |
AV:N/AC:H/Au:N/C:P/I:P/A:P
|
| psirt@mirantis.com | 8.3 | 1.6 | 6 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-346 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
https://github.com/Mirantis/security/blob/main/advisories/0001.md