PT-2021-12973 · Juniper Networks · Appformix

Published 2021-04-22 · Updated 2021-05-04 · CVE-2021-0265

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Juniper Networks AppFormix versions prior to 3.1.22, 3.2.14, 3.3.0

Description: An unvalidated REST API in the AppFormix Agent allows an unauthenticated remote attacker to execute commands as root on the host running the AppFormix Agent, granting the attacker full control over the environment.

Recommendations: For versions prior to 3.1.22, update to version 3.1.22 or later. For versions prior to 3.2.14, update to version 3.2.14 or later. For versions prior to 3.3.0, update to version 3.3.0 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-0265

Affected Products

Appformix

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-0265 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0265 · Vendor Advisory
• https://kb.juniper.net/JSA11156 · Vendor Advisory