CVE-2021-42562

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components that should only be accessible by admin users.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42562-Improper%20Access%20Control-MITRE%20CalderaExploit, Third Party Advisory
https://github.com/mitre/caldera/releasesRelease Notes, Third Party Advisory
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42562-Improper%20Access%20Control-MITRE%20CalderaExploit, Third Party Advisory
https://github.com/mitre/caldera/releasesRelease Notes, Third Party Advisory

Timeline

Published: Jan 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-425637.8There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. This may allow an authorized lo CVE-2021-425645.4An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to prov CVE-2021-425656.1myfactory.FMS before 7.1-912 allows XSS via the UID parameter.CVE-2021-425666.1myfactory.FMS before 7.1-912 allows XSS via the Error parameter.CVE-2021-425676.1Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.CVE-2021-425684.3Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged a CVE-2021-42576.1A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/tas CVE-2021-425748.3An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of charac CVE-2021-425759.8The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.CVE-2021-425769.8The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated CVE-2021-425777.5An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client crash with a NULL po CVE-2021-42587.5A vulnerability was found in whohas. It has been rated as problematic. This issue affects some unknown processing of the component Package I