What is CVE-2021-36758?

CVE-2021-36758 is a medium-severity vulnerability in 1password Connect, classified under Improper Input Validation. CVSS score: 5.4/10. Published 2021-07-16.

How severe is CVE-2021-36758?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2021-36758 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in 1password Connect

CVE-2021-36758

1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the token is created in.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.005 (38.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

1password Connect
N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

Kuromesi/Py4CSKG

References

cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-36758?: CVE-2021-36758 is a medium-severity vulnerability in 1password Connect, classified under Improper Input Validation. CVSS score: 5.4/10. Published 2021-07-16.
How severe is CVE-2021-36758?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2021-36758 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.