| ID |
CVE-2021-32634
|
| Sažetak |
Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-authenticated requests to the [`WorkSpaceClientEnqueue.action`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/WorkSpaceClientEnqueueAction.java) REST endpoint. This issue may lead to post-auth Remote Code Execution. This issue has been patched in version 6.5.0. As a workaround, one can disable network access to Emissary from untrusted sources. |
| Reference |
|
| CVSS |
| Base: | 6.5 |
| Impact: | 6.4 |
| Exploitability: | 8.0 |
|
| Pristup |
| Vektor | Složenost | Autentikacija |
| NETWORK |
LOW |
SINGLE |
|
| Impact |
| Povjerljivost | Cjelovitost | Dostupnost |
| PARTIAL |
PARTIAL |
PARTIAL |
|
| CVSS vektor |
AV:N/AC:L/Au:S/C:P/I:P/A:P |
| Zadnje važnije ažuriranje |
27-05-2021 - 22:37 |
| Objavljeno |
21-05-2021 - 18:15 |
