PT-2021-19948 · Skytable · Skytable

Sayan Nandan · Published 2021-08-03 · Updated 2021-08-11 · CVE-2021-32814

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Skytable versions prior to 0.5.1

Description The issue allows remotely connected clients to destroy and/or manipulate critical files on the host's file system through a directory traversal attack. This security bug has been patched in version 0.5.1.

Recommendations For versions prior to 0.5.1, upgrade to version 0.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-32814

GHSA-2HJ9-CXMC-M4G7

Affected Products

Skytable

References · 9

• https://github.com/skytable/skytable/commit/38b011273bb92b83c61053ae2fcd80aa9320315c#diff-1cdcf1a793c71ec658782437e4da7e3a37042bc1e2c12545942e9a14679c4b7e · Patch
• https://osv.dev/vulnerability/CVE-2021-32814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32814 · Security Note
• https://security.skytable.io/ve/s/00001.html · Patch
• https://github.com/skytable/skytable/blob/next/CHANGELOG.md#version-051-2021-03-17 · Note
• https://github.com/skytable/skytable/security/advisories/GHSA-2hj9-cxmc-m4g7 · Note
• https://t.me/cvenotify/19137 · Telegram Post
• https://t.me/cibsecurity/26755 · Telegram Post
• https://t.me/cvenotify/18554 · Telegram Post