Yomguithereal Baobab até 2.6.0 Privilege Escalation

Uma vulnerabilidade foi encontrada em Yomguithereal Baobab até 2.6.0 e classificada como crítico. Afectado é uma função desconhecida. A manipulação com uma entrada desconhecida leva a Privilege Escalation. A definição de CWE para a vulnerabilidade é CWE-1321. O aconselhamento é partilhado para download em github.com. A vulnerabilidade é identificada como CVE-2021-4307. O ataque pode ser feito a partir da rede. Não há detalhes técnicos disponíveis. Não há nenhuma exploração disponível. A técnica de ataque utilizada por esta edição é T1059 de acordo com MITRE ATT&CK. É declarado como não definido. Esperamos que o dia 0 tenha valido aproximadamente $0-$5k. A actualização para a versão 2.6.1 é capaz de abordar esta questão. A versão actualizada está pronta para ser descarregada em github.com. O nome do adesivo é c56639532a923d9a1600fb863ec7551b188b5d19. O bugfix está pronto para download em github.com. Recomenda-se a actualização do componente afectado.

Campo30/01/2023 01h3730/01/2023 01h4630/01/2023 01h53
vendorYomguitherealYomguitherealYomguithereal
nameBaobabBaobabBaobab
version<=2.6.0<=2.6.0<=2.6.0
cwe132113211321
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
identifier511511511
urlhttps://github.com/Yomguithereal/baobab/pull/511https://github.com/Yomguithereal/baobab/pull/511https://github.com/Yomguithereal/baobab/pull/511
nameActualizaçãoActualizaçãoActualização
upgrade_version2.6.12.6.12.6.1
upgrade_urlhttps://github.com/Yomguithereal/baobab/releases/tag/2.6.1https://github.com/Yomguithereal/baobab/releases/tag/2.6.1https://github.com/Yomguithereal/baobab/releases/tag/2.6.1
patch_namec56639532a923d9a1600fb863ec7551b188b5d19c56639532a923d9a1600fb863ec7551b188b5d19c56639532a923d9a1600fb863ec7551b188b5d19
patch_urlhttps://github.com/Yomguithereal/baobab/commit/c56639532a923d9a1600fb863ec7551b188b5d19https://github.com/Yomguithereal/baobab/commit/c56639532a923d9a1600fb863ec7551b188b5d19https://github.com/Yomguithereal/baobab/commit/c56639532a923d9a1600fb863ec7551b188b5d19
advisoryquoteSecurity Fix for Prototype Pollution (#511)Security Fix for Prototype Pollution (#511)Security Fix for Prototype Pollution (#511)
cveCVE-2021-4307CVE-2021-4307CVE-2021-4307
responsibleVulDBVulDBVulDB
date1673046000 (07/01/2023)1673046000 (07/01/2023)1673046000 (07/01/2023)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_auSSS
cvss2_vuldb_eNDNDND
cvss3_vuldb_prLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_eXXX
cvss2_vuldb_basescore6.56.56.5
cvss2_vuldb_tempscore5.75.75.7
cvss3_vuldb_basescore6.36.36.3
cvss3_vuldb_tempscore6.06.06.0
cvss3_meta_basescore6.37.57.5
cvss3_meta_tempscore6.07.47.4
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1673046000 (07/01/2023)1673046000 (07/01/2023)1673046000 (07/01/2023)
cve_nvd_summaryA vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The name of the patch is c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The name of the patch is c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes (&#039;prototype pollution&#039;). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The name of the patch is c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.
cvss3_nvd_avNN
cvss3_nvd_acLL
cvss3_nvd_prNN
cvss3_nvd_uiNN
cvss3_nvd_sUU
cvss3_nvd_cHH
cvss3_nvd_iHH
cvss3_nvd_aHH
cvss2_nvd_avNN
cvss2_nvd_acLL
cvss2_nvd_auSS
cvss2_nvd_ciPP
cvss2_nvd_iiPP
cvss2_nvd_aiPP
cvss3_cna_avNN
cvss3_cna_acLL
cvss3_cna_prLL
cvss3_cna_uiNN
cvss3_cna_sUU
cvss3_cna_cLL
cvss3_cna_iLL
cvss3_cna_aLL
cve_cnaVulDBVulDB
cvss2_nvd_basescore6.56.5
cvss3_nvd_basescore9.89.8
cvss3_cna_basescore6.36.3

Do you need the next level of professionalism?

Upgrade your account now!