« Volver al listado

CVE-2021-0265

Estado: ModificadaAlta (8.1)—

An unvalidated REST API in the AppFormix Agent of Juniper Networks AppFormix allows an unauthenticated remote attacker to execute commands as root on the host running the AppFormix Agent, when certain preconditions are performed by the attacker, thus granting the attacker full control over the environment. This issue affects: Juniper Networks AppFormix 3 versions prior to 3.1.22, 3.2.14, 3.3.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Juniper — Appformix

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-0265",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@juniper.net",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Contrail Insights",
          "versions": [
            {
              "status": "affected",
              "version": "3",
              "lessThan": "3.1.22, 3.2.14, 3.3.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-04-22T20:15:09.843",
  "references": [
    {
      "url": "https://kb.juniper.net/JSA11156",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@juniper.net"
    },
    {
      "url": "https://kb.juniper.net/JSA11156",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unvalidated REST API in the AppFormix Agent of Juniper Networks AppFormix allows an unauthenticated remote attacker to execute commands as root on the host running the AppFormix Agent, when certain preconditions are performed by the attacker, thus granting the attacker full control over the environment. This issue affects: Juniper Networks AppFormix 3 versions prior to 3.1.22, 3.2.14, 3.3.0."
    },
    {
      "lang": "es",
      "value": "Una API REST no comprobada en AppFormix Agent de Juniper Networks AppFormix, permite a un atacante remoto no autenticado ejecutar comandos como root en el host que ejecuta AppFormix Agent, cuando determinadas condiciones previas son llevadas a cabo por el atacante, lo que le otorga al atacante control total sobre el entorno. Este problema afecta a: Juniper Networks AppFormix versiones 3 anteriores a 3.1.22, 3.2.14, 3.3.0"
    }
  ],
  "lastModified": "2026-06-17T03:29:39.323",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:juniper:appformix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5F34E62-DBBD-4795-A80B-2D08AA8F5AF2",
              "versionEndExcluding": "3.1.22",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:juniper:appformix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF1AF84C-C7F2-437D-9F01-357DE30863CE",
              "versionEndExcluding": "3.2.14",
              "versionStartIncluding": "3.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "sirt@juniper.net"
}