GitHub Advisoryadvisory · Go

GHSA-gmph-wf7j-9gcm Etcd-io Improper Authentication vulnerability

CRITICAL Published 2023-04-04 Modified 2023-04-11 Official page ↗
Aliases
CVE-2021-28235
Ecosystem
Go
Packages
go.etcd.io/etcd/v3
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2023-04-11

Affected packages

• Go go.etcd.io/etcd/v3: 3.4.10 (no fix yet)

Description

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function. This has been fixed in v.3.5.8 and was also backported to 3.4 and 3.5.

Related

Alias · CVE (1)

  • CVE-2021-28235 Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References