CVE-2021-42951

A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new, specially crafted Algorithm and subsequently launch remote code execution with their desired result.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://algorithmia.com	Vendor Advisory
https://seclists.org/fulldisclosure/2022/Feb/33	Mailing List Third Party Advisory
http://algorithmia.com	Vendor Advisory
https://seclists.org/fulldisclosure/2022/Feb/33	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:algorithmia:msol:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:28

Type	Values Removed	Values Added
References	~~() http://algorithmia.com - Vendor Advisory~~	() http://algorithmia.com - Vendor Advisory
References	~~() https://seclists.org/fulldisclosure/2022/Feb/33 - Mailing List, Third Party Advisory~~	() https://seclists.org/fulldisclosure/2022/Feb/33 - Mailing List, Third Party Advisory

10 Mar 2022, 14:31

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 6.5 v3 : 8.8
CPE		cpe:2.3:a:algorithmia:msol::::::::
References	~~(MISC) https://seclists.org/fulldisclosure/2022/Feb/33 -~~	(MISC) https://seclists.org/fulldisclosure/2022/Feb/33 - Mailing List, Third Party Advisory
References	~~(MISC) http://algorithmia.com -~~	(MISC) http://algorithmia.com - Vendor Advisory
CWE		NVD-CWE-noinfo

01 Mar 2022, 02:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-03-01 02:15

Updated : 2024-11-21 06:28

NVD link : CVE-2021-42951

Mitre link : CVE-2021-42951

CVE.ORG link : CVE-2021-42951

JSON object : View

Products Affected

algorithmia

msol

CWE

NVD-CWE-noinfo

{"id": "CVE-2021-42951", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-03-01T02:15:07.417", "references": [{"url": "http://algorithmia.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://seclists.org/fulldisclosure/2022/Feb/33", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://algorithmia.com", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seclists.org/fulldisclosure/2022/Feb/33", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new, specially crafted Algorithm and subsequently launch remote code execution with their desired result."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota (RCE) en Algorithmia MSOL todas las versiones anteriores al 10 de octubre de 2021 de SaaS. Los usuarios pueden registrarse para obtener una cuenta y le es asignado un n\u00famero determinado de cr\u00e9ditos para probar el producto. Una vez que los usuarios son autenticados, pueden proceder a crear un nuevo Algorithmia especialmente dise\u00f1ado y posteriormente lanzar una ejecuci\u00f3n de c\u00f3digo remoto con el resultado deseado."}], "lastModified": "2024-11-21T06:28:19.570", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:algorithmia:msol:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C858F981-B372-4DDD-9590-BD5DC0E72994", "versionEndExcluding": "2021-10-10"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}