CVE-2021-42855

Published: Mar 10, 2022Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appInternals/1.0/agent/configuration" API to map the corresponding ID to a command to be executed.

Affected (3)

Products: Riverbed: Steelcentral Appinternals Dynamic Sampling Agent

Riverbed

1 product

Steelcentral Appinternals Dynamic Sampling Agent

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Riverbed Steelcentral Appinternals Dynamic Sampling Agent	From 11.0.0 to 11.8.8
Riverbed Steelcentral Appinternals Dynamic Sampling Agent	From 12.0.0 to 12.13.0
Riverbed Steelcentral Appinternals Dynamic Sampling Agent	Version 10.0.0

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://aternity.force.com/customersuccess/s/article/Local-privilege-escalation-due-to-misconfigured-write-permission-on-debug-command-config-file-CVE-2021-42855

Source: cve_disclosure@tech.gov.sg

Third Party Advisory

https://aternity.force.com/customersuccess/s/article/Local-privilege-escalation-due-to-misconfigured-write-permission-on-debug-command-config-file-CVE-2021-42855

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.