CVE-2021-21234

{"id": "CVE-2021-21234", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "published": "2021-01-05T18:15:16.443", "references": [{"url": "https://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lukashinsch/spring-boot-actuator-logview/commit/760acbb939a8d1f7d1a7dfcd51ca848eea04e772", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lukashinsch/spring-boot-actuator-logview/security/advisories/GHSA-p4q6-qxjx-8jgp", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://search.maven.org/artifact/eu.hinsch/spring-boot-actuator-logview", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package \"eu.hinsch:spring-boot-actuator-logview\". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy."}, {"lang": "es", "value": "spring-boot-actuator-logview en una biblioteca que agrega un visualizador de archivo de registro simple como endpoint del actuador de arranque de resorte. Es el paquete maven \"eu.hinsch: spring-boot-actuator-logview\". En spring-boot-actuator-logview antes de la versi\u00f3n 0.2.13 se presenta una vulnerabilidad de salto de directorio. La naturaleza de esta biblioteca es exponer un directorio de archivos de registro por medio de los endpoints HTTP de administraci\u00f3n (actuador de arranque de resorte). Tanto el nombre del archivo a visualizar como una carpeta base (relativa a la carpeta root de registro) se pueden especificar mediante par\u00e1metros de petici\u00f3n. Si bien el par\u00e1metro filename se verific\u00f3 para impedir la explotaci\u00f3n del salto de directorio (de modo que \"filename=../somefile\" no funcionar\u00eda), el par\u00e1metro base folder no se verific\u00f3 lo suficiente, por lo que \"filename=somefile&base=..\" podr\u00eda acceder a un archivo fuera del directorio base del registro). La vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.2.13. Cualquier usuario de la versi\u00f3n 0.2.12 deber\u00eda poder actualizar sin ning\u00fan problema, ya que no existen otros cambios en esa versi\u00f3n. No existe una soluci\u00f3n alternativa para corregir la vulnerabilidad que no sea actualizar o eliminar la dependencia. Sin embargo, eliminar el acceso de lectura del usuario con el que se ejecuta la aplicaci\u00f3n en cualquier directorio que no sea necesario para ejecutar la aplicaci\u00f3n puede limitar el impacto. Adem\u00e1s, el acceso al endpoint de Logview se puede limitar mediante la implementaci\u00f3n de la aplicaci\u00f3n detr\u00e1s de un proxy inverso"}], "lastModified": "2021-01-11T14:41:27.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:spring-boot-actuator-logview_project:spring-boot-actuator-logview:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F31F6783-0E0D-4F91-ACD2-E67BE0A13201", "versionEndIncluding": "0.2.12"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}