CVE-2021-3139

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2021/01/13/5Mailing List, Mitigation, Third Party Advisory
https://bugzilla.suse.com/attachment.cgi?id=844938Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1178372Issue Tracking, Third Party Advisory
https://github.com/open-iscsi/tcmu-runner/pull/644Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/01/12/12Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/01/13/5Mailing List, Mitigation, Third Party Advisory
https://bugzilla.suse.com/attachment.cgi?id=844938Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1178372Issue Tracking, Third Party Advisory
https://github.com/open-iscsi/tcmu-runner/pull/644Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/01/12/12Mailing List, Third Party Advisory

Timeline

Published: Jan 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-313995.9On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack.CVE-2021-314007.5An issue was discovered in tcp_pulloutofband() in tcp_in.c in HCC embedded InterNiche 4.0.1. The TCP out-of-band urgent-data processing func CVE-2021-314017.5An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value CVE-2021-314027.5The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-202 CVE-2021-314032.5Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 CVE-2021-314042.5Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 t CVE-2021-314057.5Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.CVE-2021-314062.5Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.CVE-2021-314077.5Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6 CVE-2021-314087.1Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 t CVE-2021-314097.5Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions CVE-2021-31417.8In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attac