PT-2021-19429 · Akkadian · Akkadian Provisioning Manager Engine+2

Cale Black + 4 · Published 2021-06-15 · Updated 2021-08-04 · CVE-2021-31581

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Akkadian Provisioning Manager Engine (PME) versions prior to 5.0.2 Akkadian OVA appliance versions prior to 3.0 Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0

Description The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command, which launches a standard vi editor interface that can then be escaped.

Recommendations For Akkadian Provisioning Manager Engine (PME) versions prior to 5.0.2, update to version 5.0.2 or later. For Akkadian OVA appliance versions prior to 3.0, update to version 3.0 or later. For Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0, update to version 3.3.0.314-4a349e0 or later.

Exploit

Fix

Cleartext Storage of Sensitive Information

Improper Privilege Management

Weakness Enumeration

CWE-312

CWE-269

Related Identifiers

CVE-2021-31581

Affected Products

Akkadian Appliance Manager

Akkadian Ova Appliance

Akkadian Provisioning Manager Engine

References · 4

• 🔥 https://rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-31581 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31581 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/3617 · Telegram Post