CVE-2021-28249

** UNSUPPORTED WHEN ASSIGNED ** CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To exploit the vulnerability, the ehealth user must create a malicious library in the writable RPATH, to be dynamically linked when the FtpCollector executable is run. The code in the library will be executed as the root user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

• CVE ID
• CVE-2021-28249

• Assigner
• cve@mitre.org

• Vulnerability Status
• Analyzed

• Published Version
• 2021-03-26T08:15:13

• Last Modified Date
• 2022-07-12T17:42:04

• Version
• 2.0

• Vector String
• AV:L/AC:L/Au:N/C:C/I:C/A:C

• Access Vector
• LOCAL

• Access Compatibility
• LOW

• Authentication
• NONE

• Confidentiality Impact
• COMPLETE

• Integrity Impact
• COMPLETE

• Availability Impact
• COMPLETE

• Base Score
• 7.2

• Severity
• HIGH

• Exploitability Score
• 3.9

• Impact Score
• 10

• Version
• 3.1

• Vector String
• CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• Attack Vector
• LOCAL

• Attack Compatibility
• LOW

• Privileges Required
• LOW

• User Interaction
• NONE

• Scope
• CHANGED

• Confidentiality Impact
• HIGH

• Availability Impact
• HIGH

• Base Score
• 8.8

• Base Severity
• HIGH

• Exploitability Score
• 2

• Impact Score
• 6