« Volver al listado

CVE-2021-42811

Estado: ModificadaMedia (6.5)—

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Thalesgroup — Safenet Keysecure

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-42811",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@thalesgroup.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@thalesgroup.com",
      "affectedData": [
        {
          "vendor": "Thales DIS",
          "product": "SafeNet KeySecure",
          "versions": [
            {
              "status": "affected",
              "version": "8.12.4",
              "versionType": "custom",
              "lessThanOrEqual": "8.12.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-06-10T11:15:07.793",
  "references": [
    {
      "url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=9278cada973f45509fd638d3f153afff&sysparm_article=KB0025953",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "psirt@thalesgroup.com"
    },
    {
      "url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=9278cada973f45509fd638d3f153afff&sysparm_article=KB0025953",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@thalesgroup.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Limitación Inapropiada de un Nombre de Ruta a un Directorio Restringido (\"Salto de Ruta\") en SafeNet KeySecure permite a un usuario autenticado leer archivos arbitrarios del sistema subyacente en el que es implementado el producto"
    }
  ],
  "lastModified": "2026-06-17T04:10:10.037",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thalesgroup:safenet_keysecure:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E779070E-4630-4E55-8D98-323101B659E7",
              "versionEndIncluding": "8.12.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@thalesgroup.com"
}