1. Home
  2. CVE Database
  3. CVE-2021-44230
MEDIUM · 6.5

CVE-2021-44230

PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an ...

Vulnerability Description

PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. In this scenario, the compromised account may have inherited read access to sensitive configuration, database, and log files.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
PortswiggerBurp Suite<= 2021.11
MicrosoftWindows-

Related Weaknesses (CWE)

CWE-732

References

FAQ

What is CVE-2021-44230?

CVE-2021-44230 is a vulnerability with a CVSS score of 6.5 (MEDIUM). PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an ...

How severe is CVE-2021-44230?

CVE-2021-44230 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-44230?

Check the references section above for vendor advisories and patch information. Affected products include: Portswigger Burp Suite, Microsoft Windows.