CVE-2021-41067

{"id": "CVE-2021-41067", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2021-12-14T16:15:09.103", "references": [{"url": "https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e", "source": "cve@mitre.org"}, {"url": "https://www.listary.com/download", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.listary.com/download", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-354"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation of update packages that can cause an installation of malicious content."}, {"lang": "es", "value": "Se ha detectado un problema en Listary versiones hasta 6. La implementaci\u00f3n inapropiada del proceso de actualizaci\u00f3n conduce a la descarga de actualizaciones de software con una conexi\u00f3n basada en HTTP /check-update. Esto puede ser explotado con t\u00e9cnicas de tipo MITM. Junto con la falta de comprobaci\u00f3n de paquetes, puede llevar a la manipulaci\u00f3n de los paquetes de actualizaci\u00f3n que puede causar una instalaci\u00f3n de contenido malicioso"}], "lastModified": "2024-11-21T06:25:22.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:listary:listary:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EAE1DA9A-E743-47E1-AB4E-4BBD974DBE20", "versionEndIncluding": "6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}