CVE-2024-21881

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x

Metrics

CVSS 4.0 8.6/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:I/V:C/RE:H/U:X

Weakness enumeration

CWE-326

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-218857.8A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certaCVE-2024-218867.8A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in CVE-2024-218879.1A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an autCVE-2024-218888.8A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a useCVE-2024-21896.1The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which couCVE-2024-218906.5The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. CVE-2024-218918.8Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-dCVE-2024-218927.8On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running withCVE-2024-218938.2A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) CVE-2024-218949.8A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malCVE-2024-218969.8The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path isCVE-2024-218975.4A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabili