← Back

CVE-2021-42550

nvd nist
Published: Dec 16, 2021Modified: Jun 17, 2026

JSON object

Loading...
6.6
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.7 / Impact: 5.9
Source: NVD

Description

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

Affected (17)

Show all products
Qos: Logback · Redhat: Satellite · Netapp: Cloud Manager, Service Level Manager, Snap Creator Framework · Siemens: Sinec Nms
Qos
1 product
Logback
Redhat
1 product
Satellite
Netapp
3 products
Cloud Manager
Service Level Manager
Snap Creator Framework
Siemens
1 product
Sinec Nms
Configuration A
12 vulnerable
Vulnerable SoftwareAffected Versions
Qos
Logback
Up to 1.2.7
Logback
Version 1.3.0 alpha0
Logback
Version 1.3.0 alpha10
Logback
Version 1.3.0 alpha1
Logback
Version 1.3.0 alpha2
Logback
Version 1.3.0 alpha3
Logback
Version 1.3.0 alpha4
Logback
Version 1.3.0 alpha5
Logback
Version 1.3.0 alpha6
Logback
Version 1.3.0 alpha7
Logback
Version 1.3.0 alpha8
Logback
Version 1.3.0 alpha9
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Satellite
Version 6.0
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Cloud Manager
All versions
Service Level Manager
All versions
Snap Creator Framework
All versions
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Sinec Nms
Before 1.0.3

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (14)

Source: vulnerability@ncsc.ch
Vendor Advisory
Source: vulnerability@ncsc.ch
ExploitThird Party AdvisoryVDB Entry
Source: vulnerability@ncsc.ch
Mailing ListThird Party Advisory
Source: vulnerability@ncsc.ch
Third Party Advisory
Source: vulnerability@ncsc.ch
ExploitThird Party Advisory
Source: vulnerability@ncsc.ch
ExploitIssue TrackingPatchThird Party Advisory
Source: vulnerability@ncsc.ch
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.