Vulnerability Description
Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library.
CVSS Score
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Druva | Insync Client | < 7.0.0 |
Related Weaknesses (CWE)
References
- http://druva.comProduct
- https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSyPatchVendor Advisory
- https://imhotepisinvisible.com/druva-lpe/ExploitPatchTechnical Description
- http://druva.comProduct
- https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSyPatchVendor Advisory
- https://imhotepisinvisible.com/druva-lpe/ExploitPatchTechnical Description
FAQ
What is CVE-2021-36667?
CVE-2021-36667 is a vulnerability with a CVSS score of 7.8 (HIGH). Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.s...
How severe is CVE-2021-36667?
CVE-2021-36667 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-36667?
Check the references section above for vendor advisories and patch information. Affected products include: Druva Insync Client.