PT-2024-19112 · Envoy · Envoy

Frank Breedijk + 2 · Published 2024-08-10 · Updated 2024-08-12 · CVE-2024-21881

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:Y/R:I/V:C/RE:H

Name of the Vulnerable Software and Affected Versions Envoy versions 4.x through 5.x

Description The issue is related to inadequate encryption strength, allowing an authenticated attacker to execute arbitrary OS commands via encrypted package upload.

Recommendations For Envoy versions 4.x through 5.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2024-21881

Affected Products

Envoy

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-21881 · Security Note
• https://enphase.com/cybersecurity/advisories/ensa-2024-6 · Vendor Advisory
• https://csirt.divd.nl/CVE-2024-21881 · Note
• https://twitter.com/CveFindCom/status/1823041963215442191 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1823006736904540542 · Twitter Post
• https://csirt.divd.nl/DIVD-2024-00011 · Note