Vulnerability · Published Apr 9, 2021 · Assigned by DeepSurface
CVE-2021-29221
High 7.0
In plain English
A high-severity security flaw in Erlang/OTP from Erlang Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS NVD)7.0High
Exploit odds (30 days)0.6%top 51.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a local attacker could hijack accounts of other users running Erlang programs or possibly coerce a service running with "erlsrv.exe" to execute arbitrary code as Local System. This can occur only under specific conditions on Windows with unsafe filesystem permissions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Erlang Project | Erlang/OTP | < 23.2.3 |