Improper input validation in Genivi Diagnostic Log And Trace
CVE-2021-29507
GENIVI Diagnostic Log and Trace (DLT) provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are using the configuration file could fail to generate their dlt logs in system. As of time of publication, no patch exists. As a workaround, one may check the integrity of information in configuration file manually.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.007 (53.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 53.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Genivi Diagnostic Log And Trace
- Genivi Dlt-Daemon — versions > 2.10.0, <= 2.18.6
Weakness classification (CWE)
References
- github.com/GENIVI/dlt-daemon/security/advisories/GHSA-7cqp-2hqj-mh3f (Third Party Advisory)
Frequently asked questions
- What is CVE-2021-29507?
- CVE-2021-29507 is a medium-severity vulnerability in Genivi Diagnostic Log And Trace, classified under Improper Input Validation. CVSS score: 5.7/10. Published 2021-05-28.
- How severe is CVE-2021-29507?
- Medium severity. CVSS v3 base score is 5.7 out of 10.