CVE-2021-37941 – elastic-apm

Package

Manager: pip
Name: elastic-apm
Vulnerable Version: >=1.10.0 <1.27.0

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00033 pctl0.08012

Details

APM Java Agent Local Privilege Escalation A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of permissions than they possess. This vulnerability affects users that have set up the agent via the attacher cli 3, the attach API 2, as well as users that have enabled the profiling_inferred_spans_enabled option

Metadata

Created: 2021-12-09T00:00:28Z
Modified: 2024-04-22T22:34:38Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-r562-m862-63w3/GHSA-r562-m862-63w3.json
CWE IDs: ["CWE-269"]
Alternative ID: GHSA-r562-m862-63w3
Finding: F159
Auto approve: 1