CVE-2021-23556 - OpenCVE

The package guake before 3.8.5 are vulnerable to Exposed Dangerous Method or Function due to the exposure of execute_command and execute_command_by_uuid methods via the d-bus interface, which makes it possible for a malicious user to run an arbitrary command via the d-bus method. **Note:** Exploitation requires the user to have installed another malicious program that will be able to send dbus signals or run terminal commands.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Guake-project	Guake

Configuration 1 [-]

cpe:2.3:a:guake-project:guake:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/Guake/guake/issues/1796
https://github.com/Guake/guake/pull/2017
https://github.com/Guake/guake/pull/2017/commits/e3d671120bfe7ba28f50e256cc5e8a629781b888
https://github.com/Guake/guake/releases
https://snyk.io/vuln/SNYK-PYTHON-GUAKE-2386334

History

No history.

MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2022-03-17T11:20:43.711518Z

Updated: 2024-09-17T02:12:07.625Z

Reserved: 2021-01-08T00:00:00

Link: CVE-2021-23556

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-03-17T12:15:07.590

Modified: 2022-03-23T18:42:17.873

Link: CVE-2021-23556

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "guake", "vendor": "n/a", "versions": [{"lessThan": "3.8.5", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "junorouse"}], "datePublic": "2022-03-17T00:00:00", "descriptions": [{"lang": "en", "value": "The package guake before 3.8.5 are vulnerable to Exposed Dangerous Method or Function due to the exposure of execute_command and execute_command_by_uuid methods via the d-bus interface, which makes it possible for a malicious user to run an arbitrary command via the d-bus method. **Note:** Exploitation requires the user to have installed another malicious program that will be able to send dbus signals or run terminal commands."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitCodeMaturity": "PROOF_OF_CONCEPT", "integrityImpact": "LOW", "privilegesRequired": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 6.1, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L/E:P", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Exposed Dangerous Method or Function", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-03-17T11:20:43", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/Guake/guake/issues/1796"}, {"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-PYTHON-GUAKE-2386334"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Guake/guake/pull/2017"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Guake/guake/pull/2017/commits/e3d671120bfe7ba28f50e256cc5e8a629781b888"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Guake/guake/releases"}], "title": "Exposed Dangerous Method or Function", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "DATE_PUBLIC": "2022-03-17T11:16:06.104077Z", "ID": "CVE-2021-23556", "STATE": "PUBLIC", "TITLE": "Exposed Dangerous Method or Function"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "guake", "version": {"version_data": [{"version_affected": "<", "version_value": "3.8.5"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "junorouse"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The package guake before 3.8.5 are vulnerable to Exposed Dangerous Method or Function due to the exposure of execute_command and execute_command_by_uuid methods via the d-bus interface, which makes it possible for a malicious user to run an arbitrary command via the d-bus method. **Note:** Exploitation requires the user to have installed another malicious program that will be able to send dbus signals or run terminal commands."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L/E:P", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Exposed Dangerous Method or Function"}]}]}, "references": {"reference_data": [{"name": "https://github.com/Guake/guake/issues/1796", "refsource": "MISC", "url": "https://github.com/Guake/guake/issues/1796"}, {"name": "https://snyk.io/vuln/SNYK-PYTHON-GUAKE-2386334", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-PYTHON-GUAKE-2386334"}, {"name": "https://github.com/Guake/guake/pull/2017", "refsource": "MISC", "url": "https://github.com/Guake/guake/pull/2017"}, {"name": "https://github.com/Guake/guake/pull/2017/commits/e3d671120bfe7ba28f50e256cc5e8a629781b888", "refsource": "MISC", "url": "https://github.com/Guake/guake/pull/2017/commits/e3d671120bfe7ba28f50e256cc5e8a629781b888"}, {"name": "https://github.com/Guake/guake/releases", "refsource": "MISC", "url": "https://github.com/Guake/guake/releases"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:14:08.606Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Guake/guake/issues/1796"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://snyk.io/vuln/SNYK-PYTHON-GUAKE-2386334"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Guake/guake/pull/2017"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Guake/guake/pull/2017/commits/e3d671120bfe7ba28f50e256cc5e8a629781b888"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Guake/guake/releases"}]}]}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2021-23556", "datePublished": "2022-03-17T11:20:43.711518Z", "dateReserved": "2021-01-08T00:00:00", "dateUpdated": "2024-09-17T02:12:07.625Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:guake-project:guake:*:*:*:*:*:*:*:*", "matchCriteriaId": "E5146579-DD67-4A97-B97C-474C0E9ABC48", "versionEndExcluding": "3.8.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The package guake before 3.8.5 are vulnerable to Exposed Dangerous Method or Function due to the exposure of execute_command and execute_command_by_uuid methods via the d-bus interface, which makes it possible for a malicious user to run an arbitrary command via the d-bus method. **Note:** Exploitation requires the user to have installed another malicious program that will be able to send dbus signals or run terminal commands."}, {"lang": "es", "value": "El paquete guake versiones anteriores a 3.8.5, es vulnerable a un M\u00e9todo o Funci\u00f3n Peligrosa Expuesta debido a una exposici\u00f3n de los m\u00e9todos execute_command y execute_command_by_uuid por medio de la interfaz d-bus, lo que hace posible que un usuario malicioso ejecute un comando arbitrario por medio del m\u00e9todo d-bus. **Nota:** Una explotaci\u00f3n requiere que el usuario haya instalado otro programa malicioso que sea capaz de enviar se\u00f1ales dbus o ejecutar comandos de terminal"}], "id": "CVE-2021-23556", "lastModified": "2022-03-23T18:42:17.873", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.7, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2022-03-17T12:15:07.590", "references": [{"source": "report@snyk.io", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/Guake/guake/issues/1796"}, {"source": "report@snyk.io", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/Guake/guake/pull/2017"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Guake/guake/pull/2017/commits/e3d671120bfe7ba28f50e256cc5e8a629781b888"}, {"source": "report@snyk.io", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/Guake/guake/releases"}, {"source": "report@snyk.io", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-PYTHON-GUAKE-2386334"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}