CVE-2021-3626CWE-284CWE-73

Windows version of Multipass unauthenticated localhost tcp control socket can perform mounts

High · published October 1, 2021

CVSS v3.1
8.8
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.3th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-73 · External Control of File Name or Path
Published
2021-10-01T02:35Z
EPSS history
Timeline
  • 01 OCT 02:35Z
    Windows version of Multipass unauthenticated localhost tcp control socket can perform mounts
    cvelistv5