CVE-2021-31215

HIGH8.8

SchedMD Slurm before 20

Published May 13, 2021

Modified 1 years ago

Details

SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.

References

WEB

https://lists.debian.org/debian-lts-announce/2022/01/msg00011.html

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ODMJQNY4FAV7G3DSKVIO5KY7Q7DKBPU/

ADVISORY

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRHTASFAU5FNB2MJOG67YID2ONQS5MCQ/

WEB

https://lists.schedmd.com/pipermail/slurm-announce/2021/000055.html

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2021-31215

WEB

https://www.schedmd.com/news.php?id=248#OPT_248

CVSS Analysis

CVSS v3.1

8.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.8/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Ecosystems

Timeline

PublishedMay 13, 2021

ModifiedAug 3, 2024

CVE-2021-31215 | Mondoo Vulnerability Intelligence