CVE-2021-42550

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

Link	Resource
https://github.com/cn-panda/logbackRceDemo	Exploit Third Party Advisory
https://jira.qos.ch/browse/LOGBACK-1591	Exploit Issue Tracking
http://logback.qos.ch/news.html	Vendor Advisory
https://security.netapp.com/advisory/ntap-20211229-0001/	Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jul/11	Mailing List Third Party Advisory
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html	Exploit Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf	Third Party Advisory

Configuration 1

cpe:2.3:a:qos:logback:1.3.0:alpha6:*:*:*:*:*:* cpe:2.3:a:qos:logback:1.3.0:alpha7:*:*:*:*:*:* cpe:2.3:a:qos:logback:1.3.0:alpha8:*:*:*:*:*:* cpe:2.3:a:qos:logback:1.3.0:alpha9:*:*:*:*:*:* cpe:2.3:a:qos:logback:1.3.0:alpha10:*:*:*:*:*:* cpe:2.3:a:qos:logback:*:*:*:*:*:*:*:* cpe:2.3:a:qos:logback:1.3.0:alpha0:*:*:*:*:*:* cpe:2.3:a:qos:logback:1.3.0:alpha1:*:*:*:*:*:* cpe:2.3:a:qos:logback:1.3.0:alpha2:*:*:*:*:*:* cpe:2.3:a:qos:logback:1.3.0:alpha3:*:*:*:*:*:* cpe:2.3:a:qos:logback:1.3.0:alpha4:*:*:*:*:*:* cpe:2.3:a:qos:logback:1.3.0:alpha5:*:*:*:*:*:* cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:* cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*

---

Published : 2021-12-16 07:15

Updated : 2022-12-12 09:13

---

NVD link : CVE-2021-42550

Mitre link : CVE-2021-42550

No products.

CWE-502

Deserialization of Untrusted Data