CVE-2021-33026

{"id": "CVE-2021-33026", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-05-13T23:15:07.367", "references": [{"url": "https://github.com/pallets-eco/flask-caching/pull/209#issuecomment-1136397937", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/sh4nks/flask-caching/pull/209", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/pallets-eco/flask-caching/pull/209#issuecomment-1136397937", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/sh4nks/flask-caching/pull/209", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision"}, {"lang": "es", "value": "** EN DISPUTA ** La extensi\u00f3n Flask-Caching hasta la versi\u00f3n 1.10.1 para Flask se basa en Pickle para la serializaci\u00f3n, lo que puede llevar a la ejecuci\u00f3n remota de c\u00f3digo o a la escalada local de privilegios. Si un atacante obtiene acceso al almacenamiento de la cach\u00e9 (por ejemplo, el sistema de archivos, Memcached, Redis, etc.), puede construir una carga \u00fatil manipulada, envenenar la cach\u00e9 y ejecutar c\u00f3digo Python. NOTA: un tercero indica que la explotaci\u00f3n es extremadamente improbable a menos que la m\u00e1quina ya est\u00e9 comprometida; en otros casos, el atacante no podr\u00eda escribir su carga \u00fatil en la cach\u00e9 y generar la colisi\u00f3n necesaria"}], "lastModified": "2024-11-21T06:08:09.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flask-caching_project:flask-caching:*:*:*:*:*:flask:*:*", "vulnerable": true, "matchCriteriaId": "04389DFA-32B3-4F65-BBDB-6321BA631F81", "versionEndIncluding": "1.10.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}