Sign-up

ID

VAR-202110-1082


CVE

CVE-2021-38379


TITLE

CFEngine Enterprise  Vulnerability regarding improper default permissions in

Trust: 0.8

sources: JVNDB: JVNDB-2021-014539

DESCRIPTION

The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure. CFEngine Enterprise There is a vulnerability in improper default permissions.Information may be obtained

Trust: 1.62

sources: NVD: CVE-2021-38379 // JVNDB: JVNDB-2021-014539

IOT TAXONOMY

category:['network device']sub_category:hub

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:northern techmodel:cfenginescope:lteversion:3.18.0

Trust: 1.0

vendor:northern techmodel:cfenginescope:gteversion:3.6.7

Trust: 1.0

vendor:northern techmodel:cfenginescope:eqversion: -

Trust: 0.8

vendor:northern techmodel:cfenginescope:eqversion:3.6.7 to 3.18.0

Trust: 0.8

sources: JVNDB: JVNDB-2021-014539 // NVD: CVE-2021-38379

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-38379
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-38379
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202110-2000
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2021-38379
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2021-38379
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2021-38379
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2021-014539 // CNNVD: CNNVD-202110-2000 // NVD: CVE-2021-38379

PROBLEMTYPE DATA

problemtype:CWE-276

Trust: 1.0

problemtype:Inappropriate default permissions (CWE-276) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-014539 // NVD: CVE-2021-38379

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202110-2000

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202110-2000

PATCH

title:CVE-2021-38379 & CVE-2021-36756 CFEngineurl:https://cfengine.com/blog/2021/cve-2021-38379-and-cve-2021-36756/

Trust: 0.8

title:Northern.tech CfEngine Repair measures for information disclosure vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=168743

Trust: 0.6

sources: JVNDB: JVNDB-2021-014539 // CNNVD: CNNVD-202110-2000

EXTERNAL IDS

db:NVDid:CVE-2021-38379

Trust: 3.3

db:JVNDBid:JVNDB-2021-014539

Trust: 0.8

db:CNNVDid:CNNVD-202110-2000

Trust: 0.6

db:OTHERid:NONE

Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2021-014539 // CNNVD: CNNVD-202110-2000 // NVD: CVE-2021-38379

REFERENCES

url:https://cfengine.com/blog/2021/cve-2021-38379-and-cve-2021-36756/

Trust: 1.6

url:https://docs.cfengine.com/docs/3.18/enterprise-cfengine-guide.html

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-38379

Trust: 0.8

url:https://ieeexplore.ieee.org/abstract/document/10769424

Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2021-014539 // CNNVD: CNNVD-202110-2000 // NVD: CVE-2021-38379

SOURCES

db:OTHERid: -
db:JVNDBid:JVNDB-2021-014539
db:CNNVDid:CNNVD-202110-2000
db:NVDid:CVE-2021-38379

LAST UPDATE DATE

2025-01-30T21:57:26.920000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2021-014539date:2022-10-20T05:27:00
db:CNNVDid:CNNVD-202110-2000date:2021-11-05T00:00:00
db:NVDid:CVE-2021-38379date:2021-11-04T13:37:43.773

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2021-014539date:2022-10-20T00:00:00
db:CNNVDid:CNNVD-202110-2000date:2021-10-27T00:00:00
db:NVDid:CVE-2021-38379date:2021-10-27T15:15:08.047