PT-2021-20363 · Confluent · Confluent Ansible

Octav Opaschi · Published 2021-09-29 · Updated 2021-10-07 · CVE-2021-33923

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Confluent Ansible (cp-ansible) versions 5.5.0 through 6.0.0

Description: The issue allows local attackers to access sensitive information, including private keys and the state database, due to insecure permissions.

Recommendations: For versions 5.5.0 through 6.0.0, update the permissions to secure sensitive information, ensuring that only authorized access is allowed to private keys and the state database. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-33923

Affected Products

Confluent Ansible

References · 5

• https://confluent.io · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33923 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33923 · Vendor Advisory
• https://t.me/cibsecurity/29624 · Telegram Post
• https://detack.de/en/cve-2021-33923 · Note