Lucene search

[email protected]CVE-2021-23555

HistoryFeb 11, 2022 - 8:15 p.m.

CVE-2021-23555

2022-02-1120:15:07

[email protected]

web.nvd.nist.gov

cve-2021-23555

package vm2

sandbox bypass

vulnerability

nvd

code execution

host machine

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.9%

JSON

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.

Affected configurations

NVD

Node

vm2_projectvm2Range<3.9.6node.js

CPENameOperatorVersion
vm2_project:vm2vm2 project vm2lt3.9.6

CPE	Name	Operator	Version
vm2_project:vm2	vm2 project vm2	lt	3.9.6

CNA Affected

[
  {
    "product": "vm2",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "3.9.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]