Glances
CVE-2021-23418
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
AnalysisAI
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks. Affected products include: Glances Project Glances. Version information: before 3.2.1.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Disable external entity processing in XML parsers, use JSON instead of XML where possible.
Command injection in Glances prior to 4.5.6 allows a local unprivileged user to execute arbitrary shell commands when ad
Glances is an open-source system cross-platform monitoring tool. versions up to 4.5.1 is affected by information exposur
Command injection in Glances system monitoring (versions 4.5.2 through 4.5.5) allows a local attacker with process-execu
Cross-origin data exfiltration in Glances web server allows remote unauthenticated attackers to read sensitive system in
Server-Side Request Forgery in Glances IP plugin allows authenticated attackers to force the monitoring application to s
SQL injection in Glances TimescaleDB export module allows local attackers to execute arbitrary SQL commands against the
Glances versions through 4.5.5 contain an incomplete fix for CVE-2026-53925: the `--disable-config-exec` flag correctly
Glances REST API prior to 4.5.6 exposes authenticated system monitoring data to untrusted cross-origin websites due to a
Cassandra export module in Glances prior to version 4.5.4 allows local privilege-escalated users to redirect monitoring
Credential disclosure in Glances prior to 4.5.6 allows unauthenticated remote attackers to retrieve plaintext usernames
Share
External POC / Exploit Code
Leaving vuln.today