CVE-2021-32834

 

Published at: - 09-09-2021 04:15

Last modified: - 25-04-2022 08:16

Total changes: - 3

Description

Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the configured Groovy sandbox. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://securitylab.github.com/advisories/GHSL-2021-063-eclipse-keti/

 

Keywords

NVD

 

CVE-2021-32834

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures