by Kastro
Paper/Archive/CVE-2021-42786

CVE-2021-42786

Aternity SteelCentral AppInternals Dynamic Sampling Agent — Remote Code Execution at AgentControllerServlet

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 81.6.816 × 2016.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple instances of the API requests. The affected endpoints do not have any input validation of the user's input that allowed a malicious payload to be injected.

Affected

ProductAffectedFixed inSource
SteelCentral AppInternals Dynamic Sampling Agent10.x–CNA
SteelCentral AppInternals Dynamic Sampling Agent12.13.0 – < 12.13.012.13.0CNA
SteelCentral AppInternals Dynamic Sampling Agent11.8.8 – < 11.8.811.8.8CNA

Scores by source

GovTech CSG (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refaternity.force.com/customersuccess/s/article/Remote-Code-Execution-at-AgentControllerServlet-CVE-2021-42786