CVE-2021-42559

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Jan 12, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-42566.1A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. ThCVE-2021-425608.8An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These CVE-2021-425618.8An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" funCVE-2021-425628.1An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to readCVE-2021-425637.8There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. This may allow an authorized loCVE-2021-425645.4An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to provCVE-2021-425656.1myfactory.FMS before 7.1-912 allows XSS via the UID parameter.CVE-2021-425666.1myfactory.FMS before 7.1-912 allows XSS via the Error parameter.CVE-2021-425676.1Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.CVE-2021-425684.3Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged aCVE-2021-42576.1A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/tasCVE-2021-425748.3An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of charac
CVE-2021-42559: High severity, CVSS 8.8 | Vulnix