GitHub_MCVELIST:CVE-2021-41110CVE-2021-41110 CWL Viewer: deserialization of untrusted data can lead to complete takeover by an attacker
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
9.5 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
75.6%
cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a SafeConstructor object, as seen in the patch.
CNA Affected
[
{
"product": "cwlviewer",
"vendor": "common-workflow-language",
"versions": [
{
"status": "affected",
"version": "< 1.3.1"
}
]
}
]Related
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
9.5 High
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
75.6%