Medium severity · published Jan 14, 2022
CVE-2021-36781
A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an…
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
Factory · Opensuse
before 0.8.1-1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-36781
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-36781
Exploit
https://bugzilla.suse.com/show_bug.cgi?id=1193484
More from Factory
7.8
CVE-2022-31256
sendmail: mail to root privilege escalation via sm-client.pre script
7.8
CVE-2021-45082
An issue was discovered in Cobbler before 3.3.1
7.8
CVE-2021-25319
A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to root
7.5
CVE-2021-41819
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names
7.5
CVE-2021-41817
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string