CVE-2021-43337 — Incorrect Authorization in Slurm

CWE-863 — Incorrect Authorization5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 32.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Schedmd SlurmFedoraproject Fedora
Timeline
PublishedNov 17
Latest updateMay 24

Description

SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env options, the access control rules in SlurmDBD may permit users to request job scripts and environment files to which they should not have access.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDschedmd/slurm21.08.0 — 21.08.4

Also affects: Fedora 34, 35

Patches

Patch: www.schedmd.com ↗Patch: www.schedmd.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-c6cp-7frc-r847: SchedMD Slurm 21↗2022-05-24
▶
OSV
CVE-2021-43337: SchedMD Slurm 21↗2021-11-17
▶
CVEList
CVE-2021-43337: SchedMD Slurm 21↗2021-11-17
▶

📋Vendor Advisories

1
Debian
CVE-2021-43337: slurm-wlm - SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites usin...↗2021
▶
CVE-2021-43337 — Incorrect Authorization in Slurm | cvebase