CVE-2021-32834
Last modified
CVE-2021-32834 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. EPSS estimates a 0.92% chance of exploitation in the next 30 days.
Description
Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Keti | All versions |
References
- https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/Exploit, Third Party Advisory
- https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-32834?
How severe is CVE-2021-32834?
How do I fix CVE-2021-32834?
Are you affected by CVE-2021-32834?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST