Vulnerability in Netflix Hollow
CVE-2021-28099
In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.
EPSS: 0.002 (15.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Netflix Hollow
- N/a Netflix Oss Hollow — versions All versions
Weakness classification (CWE)
References
- security-report@netflix.com (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-28099?
- CVE-2021-28099 is a medium-severity vulnerability in Netflix Hollow, classified under Use of Insufficiently Random Values. CVSS score: 4.4/10. Published 2021-03-23.
- How severe is CVE-2021-28099?
- Medium severity. CVSS v3 base score is 4.4 out of 10.