What is the CVSS score of CVE-2021-41192?

CVE-2021-41192 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 8.0%.

Is there a public PoC exploit available for CVE-2021-41192?

Yes, a public proof-of-concept exploit is available for CVE-2021-41192. Prioritise patching immediately. EPSS: 8.0%.

Is there a patch available for CVE-2021-41192?

Yes, a patch is available for CVE-2021-41192. Update the affected software to the latest version immediately.

Redash CVE-2021-41192

MEDIUM

Initialization of a Resource with an Insecure Default (CWE-1188)

2021-11-24 security-advisories@github.com

Information Disclosure Redash

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Nov 24, 2021 - 16:15 nvd

MEDIUM 6.5

DescriptionNVD

Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the REDASH_COOKIE_SECRET or REDASH_SECRET_KEY environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the REDASH_COOKIE_SECRET or REDASH_SECRET_KEY environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the getredash/setup repository. These instances automatically generate unique secret keys during installation. One can verify whether one's instance is affected by checking the value of the REDASH_COOKIE_SECRET environment variable. If it is c292a0a3aa32397cdb050e233733900f, should follow the steps to secure the instance, outlined in the GitHub Security Advisory.

AnalysisAI

Redash is a package for data visualization and sharing. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-1188. Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the REDASH_COOKIE_SECRET or REDASH_SECRET_KEY environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the REDASH_COOKIE_SECRET or REDASH_SECRET_KEY environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the getredash/setup repository. These instances automatically generate unique secret keys during installation. One can verify whether one's instance is affected by checking the value of the REDASH_COOKIE_SECRET environment variable. If it is c292a0a3aa32397cdb050e233733900f, should follow the steps to secure the instance, outlined in the GitHub Security Advisory. Affected products include: Redash.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.