CVE-2021-43766

2022-08-2518:15:09

CWE-295

CWE-89

[email protected]

web.nvd.nist.gov

cve-2021-43766

odyssey

sql injection

man-in-the-middle

ssl

certificate

security vulnerability

nvd

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.2%

JSON

Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. This is similar to CVE-2021-23214 for PostgreSQL.

Affected configurations

NVD

Node

odyssey_projectodysseyMatch1.1

CPENameOperatorVersion
odyssey_project:odysseyodyssey project odysseyeq1.1

CPE	Name	Operator	Version
odyssey_project:odyssey	odyssey project odyssey	eq	1.1

CNA Affected

[
  {
    "product": "Odyssey",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Odyssey 1.1"
      }
    ]
  }
]