Lucene search

ApacheCVE-2021-43410

HistoryDec 09, 2021 - 9:15 a.m.

CVE-2021-43410

2021-12-0909:15:07

CWE-116

CWE-117

apache

web.nvd.nist.gov

cve-2021-43410

apache airavata

django portal

log injection

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

61.0%

JSON

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affected: master branch before commit 3c5d8c7 [1] of airavata-django-portal [1] https://github.com/apache/airavata-django-portal/commit/3c5d8c72bfc3eb0af8693a655a5d60f9273f8170

Affected configurations

Nvd

Node

apacheairavata_django_portalRange<2021-12-06

VendorProductVersionCPE
apacheairavata_django_portal*cpe:2.3:a:apache:airavata_django_portal:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	airavata_django_portal	*	cpe:2.3:a:apache:airavata_django_portal::::::::

CNA Affected

[
  {
    "product": "Apache Airavata Django Portal",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "commit 3c5d8c7",
        "status": "affected",
        "version": "master branch",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.apache.org/thread/q64h16ofdxk29soz3jj561nysnzcrl31

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

61.0%

JSON

Related for CVE-2021-43410