PT-2021-23852 · Unknown · Alquistmanager

Ghost · Published 2021-11-12 · Updated 2021-11-16 · CVE-2021-43492

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36

Description The issue is a directory traversal vulnerability that can cause the disclosure of critical secrets stored anywhere on the system. This can significantly aid in getting remote code access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-43492

Affected Products

Alquistmanager

References · 5

• 🔥 https://github.com/AlquistManager/alquist/issues/42 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-43492 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43492 · Vendor Advisory
• https://t.me/cvenotify/23345 · Telegram Post
• https://t.me/cibsecurity/32313 · Telegram Post