« Volver al listado

CVE-2021-3806

Estado: ModificadaMedia (5.9)—

A path traversal vulnerability on Pardus Software Center's "extractArchive" function could allow anyone on the same network to do a man-in-the-middle and write files on the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tubitak — Pardus Software Center

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-3806",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.1,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:C/A:N",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "iletisim@usom.gov.tr",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "iletisim@usom.gov.tr",
      "affectedData": [
        {
          "vendor": "TUBITAK",
          "product": "Pardus Software Center",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "0.1.0~beta10",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "amd64"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2021-09-18T14:15:07.427",
  "references": [
    {
      "url": "https://pentest.blog/pardus-21-linux-distro-remote-code-execution-0day-2021/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-21-0754",
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://www.usom.gov.tr/bildirim/tr-21-0754",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "iletisim@usom.gov.tr"
    },
    {
      "url": "https://pentest.blog/pardus-21-linux-distro-remote-code-execution-0day-2021/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.usom.gov.tr/bildirim/tr-21-0754",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "iletisim@usom.gov.tr",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A path traversal vulnerability on Pardus Software Center's \"extractArchive\" function could allow anyone on the same network to do a man-in-the-middle and write files on the system."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de salto de ruta en la función \"extractArchive\" de Pardus Software Center podría permitir a cualquiera en la misma red hacer un ataque de tipo man-in-the-middle y escribir archivos en el sistema"
    }
  ],
  "lastModified": "2026-06-17T04:05:48.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tubitak:pardus_software_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25121918-E008-4595-82EB-1A9511E5BF72",
              "versionEndExcluding": "0.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "iletisim@usom.gov.tr"
}