CVE-2021-42952
Critical
Description
Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, users can then use that to subsequently escape the running context sandbox and proceed to access internal Zepl assets including cloud metadata services.
SeverityCritical
CVSS9.9
Exploit probability76. percentile1.6%
ProductZepl
PublishedFeb 25, 2022
First seenFeb 25, 2022
How to fix
Update
- zepl zepl2021-10-25 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zepl zepl | v < 2021-10-25 | 2021-10-25 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.