CVE-2021-41617

HighCVSS 7.0/10Last modified Oct 14, 2026

Description

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Sep 26, 2021
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-416197.2An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configura CVE-2021-41624.3archivy is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-416345.3A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames.CVE-2021-416358.8When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations o CVE-2021-416366.5MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire CVE-2021-416377.1Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which inclu CVE-2021-416387.5The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files on CVE-2021-416395.5MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file.CVE-2021-41648.8calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-416418.4Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method c CVE-2021-416439.8Remote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0 via the image upload field.CVE-2021-416449.8Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that by