PT-2021-22093 · Cfengine · Cfengine Enterprise

Vratislav Podzimek · Published 2021-10-27 · Updated 2024-06-27 · CVE-2021-38379

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CFEngine Enterprise versions 3.6.7 through 3.18.0

Description The issue concerns Insecure Permissions in The Hub component, which can lead to local Information Disclosure.

Recommendations For versions 3.6.7 through 3.18.0, update to a version that addresses the Insecure Permissions issue to prevent local Information Disclosure.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-38379

OPENSUSE-SU-2024:11873-1

ROSA-SA-2024-2436

Affected Products

Cfengine Enterprise

References · 8

• https://osv.dev/vulnerability/openSUSE-SU-2024:11873-1 · Vendor Advisory
• https://cfengine.com/blog/2021/cve-2021-38379-and-cve-2021-36756 · Vendor Advisory
• https://docs.cfengine.com/docs/3.18/enterprise-cfengine-guide.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38379 · Security Note
• https://suse.com/security/cve/CVE-2021-36756 · Note
• https://t.me/cibsecurity/31274 · Telegram Post
• https://suse.com/security/cve/CVE-2021-38379 · Note