CVE-2021-28235 - Vulnerability Details - OpenCVE

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Etcd	Etcd
Redhat	Openstack

Configuration 1 [-]

cpe:2.3:a:etcd:etcd:3.4.10:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat OpenStack Platform 16.1
etcd-0:3.3.23-14.el8ost	cpe:/a:redhat:openstack:16.1::el8	RHSA-2023:3447	2023-06-05T00:00:00Z
Red Hat OpenStack Platform 16.2
etcd-0:3.3.23-14.el8ost	cpe:/a:redhat:openstack:16.2::el8	RHSA-2023:3445	2023-06-05T00:00:00Z
Red Hat OpenStack Platform 17.0
etcd-0:3.4.26-1.el9ost	cpe:/a:redhat:openstack:17.0::el9	RHSA-2023:3441	2023-06-05T00:00:00Z

References

Link	Providers
http://etcd.com
https://github.com/etcd-io/etcd
https://github.com/etcd-io/etcd/pull/15648
https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png
https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png
https://nvd.nist.gov/vuln/detail/CVE-2021-28235
https://www.cve.org/CVERecord?id=CVE-2021-28235

History

Fri, 14 Feb 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-04-04T00:00:00.000Z

Updated: 2025-02-18T17:09:40.620Z

Reserved: 2021-03-12T00:00:00.000Z

Link: CVE-2021-28235

Vulnrichment

Updated: 2024-08-03T21:40:13.808Z

NVD

Status : Modified

Published: 2023-04-04T15:15:08.507

Modified: 2025-02-18T17:15:11.817

Link: CVE-2021-28235

Redhat

Severity : Important

Publid Date: 2023-04-04T00:00:00Z

Links: CVE-2021-28235 - Bugzilla

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:etcd:etcd:3.4.10:*:*:*:*:*:*:*", "matchCriteriaId": "423FB650-0346-4036-B0CE-D07170756FA4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function."}], "id": "CVE-2021-28235", "lastModified": "2025-02-18T17:15:11.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-04T15:15:08.507", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://etcd.com"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/etcd-io/etcd"}, {"source": "cve@mitre.org", "url": "https://github.com/etcd-io/etcd/pull/15648"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://etcd.com"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/etcd-io/etcd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/etcd-io/etcd/pull/15648"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj.png"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/lucyxss/etcd-3.4.10-test/blob/master/temp4cj_2.png"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:3447", "cpe": "cpe:/a:redhat:openstack:16.1::el8", "package": "etcd-0:3.3.23-14.el8ost", "product_name": "Red Hat OpenStack Platform 16.1", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3445", "cpe": "cpe:/a:redhat:openstack:16.2::el8", "package": "etcd-0:3.3.23-14.el8ost", "product_name": "Red Hat OpenStack Platform 16.2", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3441", "cpe": "cpe:/a:redhat:openstack:17.0::el9", "package": "etcd-0:3.4.26-1.el9ost", "product_name": "Red Hat OpenStack Platform 17.0", "release_date": "2023-06-05T00:00:00Z"}], "bugzilla": {"description": "etcd: Information discosure via debug function", "id": "2184441", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184441"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-287", "details": ["Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.", "A flaw was found in etcd, where etc-io could allow a remote attacker to gain elevated privileges on the system caused by a vulnerability in the debug function. By sending a specially crafted request, an attacker can gain elevated privileges."], "name": "CVE-2021-28235", "package_state": [{"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Affected", "package_name": "openshift-logging/lokistack-gateway-rhel8", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Not affected", "package_name": "openshift-serverless-1/client-kn-rhel8", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "etcd", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "etcd3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-docker-builder", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-etcd", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-machine-config-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-operator-sdk-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift-security-profiles-operator-container", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Affected", "package_name": "etcd", "product_name": "Red Hat Storage 3"}], "public_date": "2023-04-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-28235\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-28235"], "threat_severity": "Important", "upstream_fix": "go.etcd.io/etcd/v3 3.5.8"}