Vulnerability Name:

CVE-2021-24112 (CCN-196351)

Assigned:2021-02-09
Published:2021-02-09
Updated:2021-07-07
Summary:.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.1 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.6 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-24112

Source: XF
Type: UNKNOWN
ms-dotnet-cve202124112-code-exec(196351)

Source: CCN
Type: Microsoft Security TechCenter - February 2021
.NET Core for Linux Remote Code Execution Vulnerability

Source: N/A
Type: Patch, Vendor Advisory
N/A

Source: CCN
Type: IBM Security Bulletin 6852645 (Robotic Process Automation)
Vulnerabilty in the .NET Core Framework may affect IBM Robotic Process Automation and could allow an attacker to remotely execute arbitrary code.

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2021-24112

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:.net:*:*:*:*:*:*:*:* (Version >= 5.0 and <= 5.0.2)
  • OR cpe:/a:microsoft:.net_core:*:*:*:*:*:*:*:* (Version >= 2.1 and <= 2.1.24)
  • OR cpe:/a:microsoft:.net_core:*:*:*:*:*:*:*:* (Version >= 3.1 and <= 3.1.11)
  • OR cpe:/a:microsoft:mono:*:*:*:*:*:*:*:* (Version >= 6.12.0 and < 6.12.0.122)
  • OR cpe:/a:microsoft:visual_studio_2019:-:*:*:*:*:macos:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:.net_core:2.1:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_core:3.1:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:.net_core:5.0:-:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:robotic_process_automation:21.0.6:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:112418
    P
    		ibm-data-db2-6.12.0-3.1 on GA media (Moderate)
    2022-01-17
    BACK
    microsoft .net *
    microsoft .net core *
    microsoft .net core *
    microsoft mono *
    microsoft visual studio 2019 -
    microsoft .net core 2.1
    microsoft .net core 3.1
    microsoft .net core 5.0
    ibm robotic process automation 21.0.6