PT-2021-21418 · Sernet · Sernet Verinice

Frank Nusko · Published 2021-08-31 · Updated 2023-02-23 · CVE-2021-36981

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SerNet verinice versions prior to 1.22.2

Description The issue allows remote authenticated attackers to execute arbitrary code due to insecure Java deserialization.

Recommendations For versions prior to 1.22.2, update to version 1.22.2 or later to resolve the issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-36981

Affected Products

Sernet Verinice

References · 7

• 🔥 https://secianus.de/worum-geht-es/aktuelle-meldung/cve-2021-36981-verinicepro-unsafe-java-deserialization · Exploit
• 🔥 https://github.com/0xBrAinsTorM/CVE-2021-36981 · Exploit
• https://github.com/SerNet/verinice/compare/1.22.1...1.22.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-36981 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36981 · Vendor Advisory
• https://verinice.com/en/support/security-advisory · Vendor Advisory
• https://t.me/cibsecurity/28057 · Telegram Post