CVE-2021-44141
Last modified
CVE-2021-44141 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.. EPSS estimates a 1.10% chance of exploitation in the next 30 days.
Description
All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Samba | Samba | < 4.15.5 |
| Redhat | Storage | 3.0 |
| Fedoraproject | Fedora | 34 |
| Fedoraproject | Fedora | 35 |
References
- https://www.samba.org/samba/security/CVE-2021-44141.htmlMitigation, Vendor Advisory
- https://www.samba.org/samba/security/CVE-2021-44141.htmlMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-44141?
How severe is CVE-2021-44141?
How do I fix CVE-2021-44141?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-44132A command injection vulnerability in the function formImport…7.8
- CVE-2021-44135pagekit all versions, as of 15-10-2021, is vulnerable to SQL…9.8
- CVE-2021-44138There is a Directory traversal vulnerability in Caucho Resin…7.5
- CVE-2021-44139Sentinel 1.8.2 is vulnerable to Server-side request forgery …7.5
- CVE-2021-4414The Abandoned Cart Lite for WooCommerce plugin for WordPress…4.3
- CVE-2021-44140Remote attackers may delete arbitrary files in a system host…9.1
- CVE-2021-44142The Samba vfs_fruit module uses extended file attributes (EA…8.8
- CVE-2021-44143A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due…9.8
- CVE-2021-44144Croatia Control Asterix 2.8.1 has a heap-based buffer over-r…9.1
- CVE-2021-44145In the TransformXML processor of Apache NiFi before 1.15.1 a…6.5
- CVE-2021-44147An XML External Entity issue in Claris FileMaker Pro and Ser…5.5
- CVE-2021-44148GL.iNet GL-AR150 2.x before 3.x devices, configured as repea…6.1
Are you affected by CVE-2021-44141?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST