CVE-2021-3917

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Aug 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-391705.4Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a valu CVE-2021-391717.5Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SA CVE-2021-391728.8Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), ca CVE-2021-391738.8Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can CVE-2021-391748.8Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), ca CVE-2021-391756.1HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript CVE-2021-391767.5detect-character-encoding is a package for detecting character encoding using ICU. In detect-character-encoding v0.3.0 and earlier, allocate CVE-2021-391779.8Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone t CVE-2021-391786.1Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an in CVE-2021-391798.8DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL Injection vulnerability in the CVE-2021-39189.8json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-391808.8OpenOLAT is a web-based learning management system (LMS). A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16