CVE-2021-21371CWE-502

Execution of untrusted code through config file

Medium · published March 10, 2021

CVSS v3.1
5.0
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load().

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2021-03-10T21:50Z
EPSS history
Timeline
  • 10 MAR 21:50Z
    Execution of untrusted code through config file
    cvelistv5