CVE-2021-26558 - Vulnerability Details - OpenCVE

Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.02032.

Key SSVC decision points have not yet been added.

Vendors	Products
Apache	Shardingsphere-ui

Configuration 1 [-]

cpe:2.3:a:apache:shardingsphere-ui:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2021-13357	Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0.

Fixes

Solution

No solution given by the vendor.

Workaround

This issue is related to ShardingSphere-UI project. If you do not deploy UI project, it is not required to upgrade. Otherwise, the vulnerability issue of servers deployed UI project or version upgrade is supposed to consider.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2021/11/11/1
https://lists.apache.org/thread/4gzkm1zb6c97v9gl8lcz8ll5xr8o484c

History

No history.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2021-11-11T09:35:09

Updated: 2024-08-03T20:26:25.540Z

Reserved: 2021-02-02T00:00:00

Link: CVE-2021-26558

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-11-11T10:15:07.480

Modified: 2024-11-21T05:56:27.947

Link: CVE-2021-26558

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Apache ShardingSphere-UI", "vendor": "Apache Software Foundation", "versions": [{"changes": [{"at": "5.0.0", "status": "unaffected"}], "lessThan": "Apache ShardingSphere-UI*", "status": "affected", "version": "4.1.1", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0."}], "metrics": [{"other": {"content": {"other": "low"}, "type": "unknown"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-11-11T12:06:06", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.apache.org/thread/4gzkm1zb6c97v9gl8lcz8ll5xr8o484c"}, {"name": "[oss-security] 20211111 CVE-2021-26558: Apache ShardingSphere-UI: Deserialization of Untrusted Data", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2021/11/11/1"}], "source": {"discovery": "UNKNOWN"}, "title": "Deserialization of Untrusted Data", "workarounds": [{"lang": "en", "value": "This issue is related to ShardingSphere-UI project. If you do not deploy UI project, it is not required to upgrade. Otherwise, the vulnerability issue of servers deployed UI project or version upgrade is supposed to consider."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2021-26558", "STATE": "PUBLIC", "TITLE": "Deserialization of Untrusted Data"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache ShardingSphere-UI", "version": {"version_data": [{"version_affected": ">=", "version_name": "Apache ShardingSphere-UI", "version_value": "4.1.1"}, {"version_affected": "<", "version_name": "Apache ShardingSphere-UI", "version_value": "5.0.0"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{"other": "low"}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-502 Deserialization of Untrusted Data"}]}]}, "references": {"reference_data": [{"name": "https://lists.apache.org/thread/4gzkm1zb6c97v9gl8lcz8ll5xr8o484c", "refsource": "MISC", "url": "https://lists.apache.org/thread/4gzkm1zb6c97v9gl8lcz8ll5xr8o484c"}, {"name": "[oss-security] 20211111 CVE-2021-26558: Apache ShardingSphere-UI: Deserialization of Untrusted Data", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2021/11/11/1"}]}, "source": {"discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "This issue is related to ShardingSphere-UI project. If you do not deploy UI project, it is not required to upgrade. Otherwise, the vulnerability issue of servers deployed UI project or version upgrade is supposed to consider."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:26:25.540Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lists.apache.org/thread/4gzkm1zb6c97v9gl8lcz8ll5xr8o484c"}, {"name": "[oss-security] 20211111 CVE-2021-26558: Apache ShardingSphere-UI: Deserialization of Untrusted Data", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2021/11/11/1"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2021-26558", "datePublished": "2021-11-11T09:35:09", "dateReserved": "2021-02-02T00:00:00", "dateUpdated": "2024-08-03T20:26:25.540Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:shardingsphere-ui:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9583F72-6672-4410-8625-7F3EC0D255FC", "versionEndExcluding": "5.0.0", "versionStartIncluding": "4.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0."}, {"lang": "es", "value": "Una vulnerabilidad de Deserializaci\u00f3n de Datos No Confiables de Apache ShardingSphere-UI permite a un atacante inyectar recursos de enlace externo. Este problema afecta a Apache ShardingSphere-UI versiones 4.1.1 y posteriores; Apache ShardingSphere-UI versiones anteriores a 5.0.0"}], "id": "CVE-2021-26558", "lastModified": "2024-11-21T05:56:27.947", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-11-11T10:15:07.480", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/11/11/1"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/4gzkm1zb6c97v9gl8lcz8ll5xr8o484c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/11/11/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/4gzkm1zb6c97v9gl8lcz8ll5xr8o484c"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}