What is CVE-2021-28154?

CVE-2021-28154 is a critical-severity vulnerability in Camunda Modeler, classified under Missing Authorization. CVSS score: 9.1/10. Published 2021-03-11.

How severe is CVE-2021-28154?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Auth bypass in Camunda Modeler

CVE-2021-28154

Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which manipulates the readFile and writeFile APIs. NOTE: the vendor states "The way we secured the app is that it does not allow any remote scripts to be opened, no unsafe scripts to be evaluated, no remote sites to be browsed.

Vulnerability class: Broken Access Control

EPSS: 0.015 (71.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Camunda Modeler
N/a — versions n/a

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2021-28154?: CVE-2021-28154 is a critical-severity vulnerability in Camunda Modeler, classified under Missing Authorization. CVSS score: 9.1/10. Published 2021-03-11.
How severe is CVE-2021-28154?: Critical severity. CVSS v3 base score is 9.1 out of 10.