Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-X23Q-4J9J-9CXW
HistoryMay 24, 2022 - 7:17 p.m.

Ops CLI Deserialization of Untrusted Data vulnerability

2022-05-2419:17:41
CWE-502
GitHub Advisory Database
github.com
5
ops cli
version 2.0.4
deserialization
untrusted data
arbitrary code execution
maliciously crafted file
attacker
victim machine

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.156

Percentile

96.0%

JSON

Ops CLI version 2.0.4 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkout_repo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine.

Affected configurations

Vulners
Node
adobeops-cliRange≤2.0.4
VendorProductVersionCPE
adobeops-cli*cpe:2.3:a:adobe:ops-cli:*:*:*:*:*:*:*:*

Related

cve 1
prion 1
osv 2
adobe 1
veracode 1
cvelist 1
nvd 1
cve
cve
CVE-2021-40720
2021-10-15 15:15:08
prion
prion
Deserialization of untrusted data
2021-10-15 15:15:00
osv
osv
PYSEC-2021-380
2021-10-15 15:15:00
CVE-2021-40720
2021-10-15 15:15:08
adobe
adobe
APSB21-88  Security update available for Adobe ops-cli
2021-10-12 00:00:00
veracode
veracode
Deserialization Of Untrusted Data
2024-04-30 07:47:07
cvelist
cvelist
CVE-2021-40720 Ops CLI Deserialization of Untrusted Data leads to Abritrary Code Execution
2021-10-15 14:22:00
nvd
nvd
CVE-2021-40720
2021-10-15 15:15:08

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.156

Percentile

96.0%

JSON
Related for GHSA-X23Q-4J9J-9CXW
cve1prion1osv2adobe1veracode1cvelist1nvd1