CVE-2021-29221: erlang project erlang/otp Untrusted Search Path
Vulnerability summary
CVE-2021-29221 is a high (CVSS 7.0) Untrusted Search Path vulnerability in erlang project erlang/otp. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 09-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a local attacker could hijack accounts of other users running Erlang programs or possibly coerce a service running with "erlsrv.exe" to execute arbitrary code as Local System. This can occur only under specific conditions on Windows with unsafe filesystem permissions.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.58% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (deepsurface.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Erlang1 product
- erlang\/otp< 23.2.3
Erlang project1 product
- erlang/otp< 23.2.3
2 vendors · 2 products
References
2 links- deepsurface.com/deepsurface-security-advisory-local-privilege-escalation-in-erlang-on-windows-cve-2021-29221X Refsource MISCExploitThird Party Advisory