Vulnerability · Published Mar 26, 2021 · Assigned by mitre
CVE-2021-28250
High 7.8
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.3%top 72.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a setuid (and/or setgid) file. When a component is run as an argument of the runpicEhealth executable, the script code will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Affected products (as reported)
References
- https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/ x_refsource_MISC