PT-2021-22900 · Unknown · Adaptivescale Lxdui

Real-Xkli · Published 2021-09-03 · Updated 2022-05-24 · CVE-2021-40494

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AdaptiveScale LXDUI versions 2.1.3 and earlier

Description A hardcoded JWT secret key in metadata.py allows attackers to gain admin access to the host system. This issue affects AdaptiveScale LXDUI, enabling potential attackers to exploit the hardcoded key for unauthorized system access.

Recommendations For AdaptiveScale LXDUI versions 2.1.3 and earlier, update to a version that does not contain the hardcoded JWT secret key to prevent admin access exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-40494

GHSA-P4XH-4869-8VRG

PYSEC-2021-342

Affected Products

Adaptivescale Lxdui

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-40494 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40494 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p4xh-4869-8vrg · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-342 · Vendor Advisory
• https://github.com/AdaptiveScale/lxdui/pull/353 · Note
• https://github.com/AdaptiveScale/lxdui/commit/e4bffeb9d69a5700a642cb6424453d1894e50d84 · Note
• https://github.com/AdaptiveScale/lxdui · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/lxdui/PYSEC-2021-342.yaml · Note
• https://t.me/cvenotify/20625 · Telegram Post