CVE-2021-22538

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event would be captured in the Event Log.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-225397.8An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace CVE-2021-22548.1Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Hold Management). Supported versions that are a CVE-2021-225406.1Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logi CVE-2021-225437.8An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages be CVE-2021-225457.8An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the a CVE-2021-225477.8In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger CVE-2021-225487.8An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memo CVE-2021-225497.8An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 CVE-2021-22558.1Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Supported versions that are affecte CVE-2021-225507.8An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended t CVE-2021-225525.5An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader CVE-2021-225537.5Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispos