CVE-2021-44038

CWE-59CWE-287 — Improper AuthenticationCWE-269 — Improper Privilege Management6 documents6 sources
Severity
7.8HIGH
EPSS
0.2%
top 58.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Quagga Quagga
Timeline
PublishedNov 19
Latest updateNov 20

Description

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

▶NVDquagga/quagga1.2.4

🔴Vulnerability Details

3
GHSA
GHSA-h99v-fr29-7p28: An issue was discovered in Quagga through 1↗2021-11-20
▶
CVEList
CVE-2021-44038: An issue was discovered in Quagga through 1↗2021-11-19
▶
OSV
CVE-2021-44038: An issue was discovered in Quagga through 1↗2021-11-19
▶

📋Vendor Advisories

2
Red Hat
quagga: unsafe chown/chmod operations may lead to privileges escalation↗2021-11-19
▶
Microsoft
An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privi↗2021-11-09
▶
CVE-2021-44038 (HIGH CVSS 7.8) | An issue was discovered in Quagga t | cvebase.io