CVE-2021-41583

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS filesystem access, because of the interaction of QR codes with an exec that uses the -r option. This can be leveraged to obtain additional VPN access.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-415847.5Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configura CVE-2021-415857.5Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop CVE-2021-415867.5In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.CVE-2021-415877.5In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other re CVE-2021-415888.1In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have CVE-2021-415899.8In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code executi CVE-2021-41594.4A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be ret CVE-2021-415905.3In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installati CVE-2021-415919.4ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure.CVE-2021-415929.4Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure.CVE-2021-415938.6Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure.CVE-2021-415946.5In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API req