PT-2021-23567 · Beyondtrust · Beyondtrust Privilege Management

Ronnie Salomonsen · Published 2021-11-19 · Updated 2021-11-24 · CVE-2021-42254

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BeyondTrust Privilege Management versions prior to 21.6

Description The issue arises from the creation of a temporary file in a directory with insecure permissions. This is a general information about the problem, but specific details such as the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited are not provided.

Recommendations For versions prior to 21.6, update to version 21.6 or later to resolve the issue.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2021-42254

Affected Products

Beyondtrust Privilege Management

References · 5

• https://osv.dev/vulnerability/CVE-2021-42254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42254 · Security Note
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0008/MNDT-2021-0008.md · Note
• https://t.me/cibsecurity/32740 · Telegram Post
• https://beyondtrust.com/blog · Note