PT-2025-1359 · Unknown · Replicated Classic

Stephan Sekula · Published 2025-01-23 · Updated 2025-01-24 · CVE-2021-42718

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Replicated Classic versions prior to 2.53.1

Description The issue allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables through the Admin Console API on port 8800. This data is shared over authenticated sessions to the Admin Console only, and was never displayed or used in the application processing. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations To resolve the issue, update to version 2.53.1 or later. As a temporary workaround, consider restricting access to the Admin Console API on port 8800 to minimize the risk of exploitation. Avoid using environment variables that may contain sensitive data in container definitions until the issue is resolved.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2021-42718

Affected Products

Replicated Classic

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-42718 · Security Note
• https://t.me/cvedetector/16247 · Telegram Post
• https://replicated.com/cve-2021-42718 · Note
• https://twitter.com/CVEnew/status/1882612834665967668 · Twitter Post
• https://t.me/cvenotify/108445 · Telegram Post