NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/162617/NetMotion-Mobility-Server-MvcUtil-Java-Deserialization.html | Exploit Third Party Advisory VDB Entry |
https://ssd-disclosure.com/?p=4676 | Exploit Third Party Advisory |
https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/ | Exploit Third Party Advisory |
https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 May 2021, 16:52
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) http://packetstormsecurity.com/files/162617/NetMotion-Mobility-Server-MvcUtil-Java-Deserialization.html - Exploit, Third Party Advisory, VDB Entry |
18 May 2021, 18:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
23 Feb 2021, 16:22
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 9.3
v3 : 8.1 |
11 Feb 2021, 14:49
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-502 | |
CPE | cpe:2.3:a:netmotionsoftware:netmotion_mobility:*:*:*:*:*:*:*:* | |
References | (MISC) https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 - Vendor Advisory | |
References | (MISC) https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/ - Exploit, Third Party Advisory | |
References | (MISC) https://ssd-disclosure.com/?p=4676 - Exploit, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 10.0
v3 : 9.8 |
08 Feb 2021, 22:19
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-02-08 22:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-26914
Mitre link : CVE-2021-26914
CVE.ORG link : CVE-2021-26914
JSON object : View
Products Affected
netmotionsoftware
- netmotion_mobility
CWE
CWE-502
Deserialization of Untrusted Data