PT-2021-21932 · Unknown · Apm Java Agent

Douglasday · Published 2021-12-08 · Updated 2021-12-14 · CVE-2021-37941

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: APM Java agent (affected versions not specified)

Description: A local privilege escalation issue was found, allowing a user to attach a malicious file to an application running with the APM Java agent. This could enable a malicious user to run commands at a higher level of permissions. The issue affects setups via the attacher cli, the attach API, and configurations with the profiling inferred spans enabled option.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-37941

GHSA-R562-M862-63W3

Affected Products

Apm Java Agent

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-37941 · Security Note
• https://osv.dev/vulnerability/GHSA-r562-m862-63w3 · Vendor Advisory
• https://discuss.elastic.co/t/apm-java-agent-security-update/289627 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37941 · Vendor Advisory
• https://github.com/elastic/apm-agent-python · Note