What is CVE-2021-42952?

CVE-2021-42952 is a critical-severity vulnerability in Zepl. CVSS score: 9.9/10. Published 2022-02-25.

How severe is CVE-2021-42952?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Is CVE-2021-42952 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Zepl

CVE-2021-42952

Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, users can then use that to subsequently escape the running context sandbox and proceed to access internal Zepl assets including cloud metadata services.

EPSS: 0.016 (72.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Zepl
N/a — versions n/a

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

af854a3a-2127-422b-91ae-364da2661108 (Product, x_refsource_MISC, Vendor Advisory)
cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-42952?: CVE-2021-42952 is a critical-severity vulnerability in Zepl. CVSS score: 9.9/10. Published 2022-02-25.
How severe is CVE-2021-42952?: Critical severity. CVSS v3 base score is 9.9 out of 10.
Is CVE-2021-42952 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.