CVE-2021-22538
Privilege escalation in RBAC system
- State
- Published
- Severity
- 6.3 Medium
- Published
- Mar 31, 2021
- Updated
- Aug 3, 2024
- Reserved
- Jan 5, 2021
Description
A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event would be captured in the Event Log.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
Exposure Notifications Verification ServerGoogle LLC |
|
References
- https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-5v95-v8c8-3rh6
- https://github.com/google/exposure-notifications-verification-server/commit/eb8cf40b12dbe79304f1133c06fb73419383cd95
- https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.23.1
- https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.24.0
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.