PT-2021-8821 · Unknown · Versa Analytics

Published 2021-05-26 · Updated 2021-06-07 · CVE-2018-16497

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Versa Analytics (affected versions not specified)

Description The issue concerns the use of cron jobs in Versa Analytics for scheduling tasks by executing commands at specific dates and times on the server. A potential privilege escalation issue arises when a job is run as the user root, and it executes a script that is writable by users who are members of the versa group.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2018-16497

Affected Products

Versa Analytics

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-16497 · Security Note
• https://t.me/cvenotify/15694 · Telegram Post
• https://hackerone.com/reports/1168194 · Note