9

CVE-2021-44657

Exploit

EPSS 2.64%
Veröffentlicht 15.12.2021 15:15:11
Zuletzt bearbeitet 21.11.2024 06:31:19
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Stackstorm ≫ Stackstorm Version < 3.6.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	2.64%	0.853

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C

Es wurden noch keine Informationen zu CWE veröffentlicht.

https://github.com/StackStorm/st2/pull/5359

Patch

Third Party Advisory

https://github.com/pallets/jinja/issues/549

Third Party Advisory

Exploit

Issue Tracking

https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/

Third Party Advisory

Exploit

https://stackstorm.com/2021/12/16/stackstorm-v3-6-0-released/

Vendor Advisory

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-44657

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-44657

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-44657

EUVD