CVE-2021-25224

{"id": "CVE-2021-25224", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2021-01-27T19:15:13.437", "references": [{"url": "https://success.trendmicro.com/solution/000284207", "tags": ["Patch", "Vendor Advisory"], "source": "security@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-085/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can cause a denial-of-service on the affected product. The specific flaw exists within a manual scan component. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad de agotamiento de la memoria en Trend Micro ServerProtect para Linux versi\u00f3n 3.0, podr\u00eda permitir a un atacante local dise\u00f1ar archivos espec\u00edficos que pueden causar una denegaci\u00f3n de servicio en el producto afectado. El fallo espec\u00edfico se presenta dentro de un componente de escaneo manual. Un atacante primero debe obtener la capacidad de ejecutar c\u00f3digo poco privilegiado en el sistema objetivo a fin de explotar esta vulnerabilidad"}], "lastModified": "2021-02-01T19:20:52.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:serverprotect:3.0:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "D0E9F49F-7151-4150-A31D-CA68D0D4C268"}], "operator": "OR"}]}], "sourceIdentifier": "security@trendmicro.com"}