CVE-2021-22538
Medium
Description
A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event would be captured in the Event Log.
SeverityMedium
CVSS6.3
Exploit probability—
Product
Google Exposure Notifications Verification Server
PublishedMar 31, 2021
First seenMar 31, 2021
Weakness typeCWE-20Improper input validation
How to fix
Update
- google exposure_notifications_verification_server0.23.1 or later
- github.com/google/exposure-notifications-verification-server0.23.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google exposure_notifications_verification_server | v < 0.23.1 | 0.23.1 |
| github.com/google/exposure-notifications-verification-serverGo | v < 0.23.1 | 0.23.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.