PT-2021-23627 · Rasa · Rasa X

Rasa-Jmac · Published 2021-10-22 · Updated 2021-10-28 · CVE-2021-42556

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rasa X versions prior to 0.42.4

Description The issue allows Directory Traversal during archive extraction. In the functionality that allows a user to load a trained model archive, an attacker has arbitrary write capability within specific directories via a crafted archive file.

Recommendations For versions prior to 0.42.4, update to version 0.42.4 or later to resolve the issue. As a temporary workaround, consider restricting the functionality that allows users to load trained model archives until a patch is applied. Avoid using crafted archive files that could exploit the Directory Traversal vulnerability.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-42556

GHSA-VP2H-J6PX-56RC

Affected Products

Rasa X

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-42556 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42556 · Vendor Advisory
• https://rasa.com · Note
• https://github.com/RasaHQ/rasa-x-security-advisories/security/advisories/GHSA-vp2h-j6px-56rc · Note
• https://t.me/cibsecurity/31055 · Telegram Post
• https://t.me/cvenotify/22559 · Telegram Post