8.5

CVE-2021-42550: netapp cloud_manager Deserialization of Untrusted Data

CVSS: 8.5v2.0HighModified
AliasesSUSE-SU-2023:2097-1UBUNTU-CVE-2021-42550DEBIAN-CVE-2021-42550
Published 16-12-2021Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2021-42550 is a high (CVSS 8.5) Deserialization of Untrusted Data vulnerability in netapp cloud_manager. EPSS estimates a 4.77% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.5/10
010
High · v2.0 (NVD)
EPSS score
4.77%
0%100%
Low · +0.33 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3github, reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
RHSA-2022:5498USN-7616-1

Timeline

  1. 16-12-2021
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

4.77%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

+0.33 pp

From 4.44% on 18-09-2026

18-09-202618-10-2026
EPSS score
4.77%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • githubUnverified

    Logbackrcedemo

    Maturity: poc

  • referenceUnverified

    Exploit Reference (jira.qos.ch)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse67 products
  • antlr3-java&distro=SUSE Manager Server Module 4.3< 3.5.3-150200.3.11.8
  • maven&distro=SUSE Enterprise Storage 7< 3.8.6-150200.4.9.8
  • maven&distro=SUSE Enterprise Storage 7.1< 3.8.6-150200.4.9.8
  • maven&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 3.8.6-150200.4.9.8
  • maven&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 3.8.6-150200.4.9.8
Chainguard20 products
  • eco-java-gradle-1.11All versions (No fix recorded)
  • eco-java-gradle-2.0All versions (No fix recorded)
  • eco-java-gradle-2.1All versions (No fix recorded)
  • eco-java-gradle-2.10All versions (No fix recorded)
  • eco-java-gradle-2.11All versions (No fix recorded)
Opensuse12 products
  • antlr3-bootstrap&distro=openSUSE Leap 15.4< 3.5.3-150200.3.11.8
  • antlr3-java&distro=openSUSE Leap 15.4< 3.5.3-150200.3.11.8
  • antlr3&distro=openSUSE Leap 15.4< 3.5.3-150200.3.11.8
  • maven&distro=openSUSE Leap 15.4< 3.8.6-150200.4.9.8
  • minlog&distro=openSUSE Leap 15.4< 1.3.1-150200.3.7.8
Netapp3 products
Ch.qos.logback1 product
  • logback-core< 1.2.9
Debian1 product
  • logback< 1:1.2.8-1
Qos1 product
  • logback≤ 1.2.7 | 1.3.0:alpha0 | 1.3.0:alpha1 | 1.3.0:alpha10 | 1.3.0:alpha2 | 1.3.0:alpha3 | 1.3.0:alpha4 | 1.3.0:alpha5 | 1.3.0:alpha6 | 1.3.0:alpha7 | 1.3.0:alpha8 | 1.3.0:alpha9
Qos.ch1 product
  • logback≥ unspecified, < 1.2.9 | ≥ unspecified, < 1.3.0-alpha11
Redhat1 product
Siemens1 product
Ubuntu1 product
  • logback< 1:1.1.3-2ubuntu0.1~esm1 | < 1:1.2.3-2ubuntu1~18.04.1+esm1 | < 1:1.2.3-5ubuntu0.1~esm1

11 vendors · 109 products

References

21 links
Show all 21 references