CVE-2021-20702 - OpenCVE

Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nec	Clusterpro X Clusterpro X Singleserversafe Expresscluster X Expresscluster X Singleserversafe

Configuration 1 [-]

OR	cpe:2.3:a:nec:clusterpro_x::::::windows::*
	cpe:2.3:a:nec:clusterpro_x_singleserversafe::::::windows::*
	cpe:2.3:a:nec:expresscluster_x::::::windows::*
	cpe:2.3:a:nec:expresscluster_x_singleserversafe::::::windows::*

No data.

References

Link	Providers
https://jpn.nec.com/security-info/secinfo/nv21-015_en.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: NEC

Published: 2021-11-02T23:30:03

Updated: 2024-08-03T17:45:45.531Z

Reserved: 2020-12-17T00:00:00

Link: CVE-2021-20702

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-11-03T00:15:07.753

Modified: 2023-11-07T03:29:11.997

Link: CVE-2021-20702

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "CLUSTERPRO X", "vendor": "NEC Corporation", "versions": [{"status": "affected", "version": "CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier"}]}], "descriptions": [{"lang": "en", "value": "Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network."}], "problemTypes": [{"descriptions": [{"description": "Buffer overflow", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-12-17T16:10:24", "orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282", "shortName": "NEC"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://jpn.nec.com/security-info/secinfo/nv21-015_en.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt-info@cyber.jp.nec.com", "ID": "CVE-2021-20702", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "CLUSTERPRO X", "version": {"version_data": [{"version_value": "CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier"}]}}]}, "vendor_name": "NEC Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Buffer overflow"}]}]}, "references": {"reference_data": [{"name": "https://jpn.nec.com/security-info/secinfo/nv21-015_en.html", "refsource": "MISC", "url": "https://jpn.nec.com/security-info/secinfo/nv21-015_en.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:45:45.531Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jpn.nec.com/security-info/secinfo/nv21-015_en.html"}]}]}, "cveMetadata": {"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282", "assignerShortName": "NEC", "cveId": "CVE-2021-20702", "datePublished": "2021-11-02T23:30:03", "dateReserved": "2020-12-17T00:00:00", "dateUpdated": "2024-08-03T17:45:45.531Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nec:clusterpro_x:*:*:*:*:*:windows:*:*", "matchCriteriaId": "109DED36-3D51-4EDF-8187-63F3415BC2B7", "versionEndIncluding": "4.3", "versionStartIncluding": "1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nec:clusterpro_x_singleserversafe:*:*:*:*:*:windows:*:*", "matchCriteriaId": "AADFE051-D950-4027-B9C4-EB53B3881001", "versionEndIncluding": "4.3", "versionStartIncluding": "1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nec:expresscluster_x:*:*:*:*:*:windows:*:*", "matchCriteriaId": "EBD9B299-1A5E-4329-BC51-606A0EF00822", "versionEndIncluding": "4.3", "versionStartIncluding": "1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nec:expresscluster_x_singleserversafe:*:*:*:*:*:windows:*:*", "matchCriteriaId": "5717B4C8-9622-4A08-9E29-E6B66800CE99", "versionEndIncluding": "4.3", "versionStartIncluding": "1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network."}, {"lang": "es", "value": "La vulnerabilidad de desbordamiento del b\u00fafer en el Servidor de Transacciones CLUSTERPRO X 4.3 para Windows y anteriores, EXPRESSCLUSTER X 4.3 para Windows y anteriores, CLUSTERPRO X 4.3 SingleServerSafe para Windows y anteriores, EXPRESSCLUSTER X 4.3 SingleServerSafe para Windows y anteriores permite a un atacante la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de una red"}], "id": "CVE-2021-20702", "lastModified": "2023-11-07T03:29:11.997", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-11-03T00:15:07.753", "references": [{"source": "psirt-info@cyber.jp.nec.com", "url": "https://jpn.nec.com/security-info/secinfo/nv21-015_en.html"}], "sourceIdentifier": "psirt-info@cyber.jp.nec.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}]}