« Volver al listado

CVE-2021-22030

Estado: ModificadaMedia (6.5)—

In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) information in the logs of the database. A malicious user with access to logs can read sensitive(credentials) information about users

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Greenplum — Greenplum

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22030",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "GPDB (Greenplum database)",
          "versions": [
            {
              "status": "affected",
              "version": "gpfdist (Greenplum) versions 6.x  prior to 6.17.0 and 5.28.x prior to 5.28.14"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-19T17:15:07.973",
  "references": [
    {
      "url": "https://github.com/greenplum-db/gpdb/security/advisories/GHSA-c7w8-gx27-h4mr",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://github.com/greenplum-db/gpdb/security/advisories/GHSA-c7w8-gx27-h4mr",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vmware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) information in the logs of the database. A malicious user with access to logs can read sensitive(credentials) information about users"
    },
    {
      "lang": "es",
      "value": "En las versiones de Greenplum database anteriores a 5.28.14 y 6.17.0, una ejecución de determinadas sentencias conllevaba a un almacenamiento de información confidencial (credenciales) en los registros de la base de datos. Un usuario malicioso con acceso a los registros puede leer información confidencial(credenciales) sobre los usuarios"
    }
  ],
  "lastModified": "2026-06-17T03:36:34.983",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:greenplum:greenplum:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11CE6177-E800-4AB6-92BF-71FA4E6EA8C1",
              "versionEndExcluding": "5.28.14"
            },
            {
              "criteria": "cpe:2.3:a:greenplum:greenplum:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED15D01E-172F-4ECB-BF75-3B15D4D5FD26",
              "versionEndExcluding": "6.17.0",
              "versionStartIncluding": "6.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}