CyberSec.Space Logo
返回 CVE 瀏覽器

CVE-2021-45809

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.1590%
EPSS Percentile44.14th
Published2022年3月22日
Last Modified2024年11月21日

Vulnerability Description

GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Application. The way GlobalProtect-Openconnect is set up enables arbitrary users to execute commands as root by submitting the `--script=<script>` parameter.

Affected Platforms (CPE)

📦
Globalprotect Openconnect Project

Globalprotect Openconnect

< 1.4.3

References & Advisories

🔗 https://github.com/yuezk/GlobalProtect-openconnect/issues/113
🔗 https://github.com/yuezk/GlobalProtect-openconnect/issues/113

相關漏洞威脅

CVE-2021-458107.5

GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService through DBUS, ...

CVE-2026-53430

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Mes...

CVE-2026-48854

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust...

CVE-2026-48853

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc all...