What is the CVSS score of CVE-2021-42550?

CVE-2021-42550 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 4.4%.

Is there a public PoC exploit available for CVE-2021-42550?

Yes, a public proof-of-concept exploit is available for CVE-2021-42550. Prioritise patching immediately. EPSS: 4.4%.

Is there a patch available for CVE-2021-42550?

Yes, a patch is available for CVE-2021-42550. Update the affected software to the latest version immediately.

Logback CVE-2021-42550

MEDIUM

Deserialization of Untrusted Data (CWE-502)

2021-12-16 vulnerability@ncsc.ch

Deserialization RCE Logback Satellite Cloud Manager Service Level Manager Snap Creator Framework Sinec Nms

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Dec 16, 2021 - 19:15 nvd

MEDIUM 6.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3,478 maven packages depend on ch.qos.logback:logback-core (308 direct, 3,171 indirect)

Ecosystem-wide dependent count for version 1.2.9.

DescriptionNVD

AnalysisAI

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers. Affected products include: Qos Logback, Redhat Satellite, Netapp Cloud Manager, Netapp Service Level Manager, Netapp Snap Creator Framework. Version information: version 1.2.7.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.