CVE-2021-28246

** UNSUPPORTED WHEN ASSIGNED ** CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3 7.8 HIGH
CVSS v2.0 4.4 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/	Exploit Third Party Advisory
https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:broadcom:ehealth:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:59

Type	Values Removed	Values Added
References	~~() https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/ - Exploit, Third Party Advisory~~	() https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/ - Exploit, Third Party Advisory

Information

Published : 2021-03-26 08:15

Updated : 2024-11-21 05:59

NVD link : CVE-2021-28246

Mitre link : CVE-2021-28246

CVE.ORG link : CVE-2021-28246

JSON object : View

Products Affected

broadcom

ehealth

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2021-28246", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-03-26T08:15:12.730", "references": [{"url": "https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-426"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer"}, {"lang": "es", "value": "** NO COMPATIBLE CUANDO SE ASIGN\u00d3 ** CA eHealth Performance Manager versiones hasta 6.3.2.12, est\u00e1 afectado por una Escalada de Privilegios por medio de una Dynamically Linked Shared Object Library. Un usuario normal debe crear una biblioteca maliciosa en el RPATH escribible, que se vincular\u00e1 din\u00e1micamente cuando se ejecutar el ejecutable emtgtctl2. El c\u00f3digo de la biblioteca se ejecutar\u00e1 como usuario de ehealth. NOTA: Esta vulnerabilidad solo afecta a los productos que ya no son compatibles por el mantenedor."}], "lastModified": "2024-11-21T05:59:23.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:ehealth:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93837978-6B5C-40C4-B54A-C64FE98507C2", "versionEndIncluding": "6.3.2.12"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}