Vulnerability · Published Apr 20, 2021 · Assigned by palo_alto
CVE-2021-3035Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution
Medium 6.7
In plain English
A medium-severity unsafe deserialization in Bridgecrew Checkov from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)1.3%top 29.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Bridgecrew Checkov | 2.0 – before 2.0.26 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
References
- https://security.paloaltonetworks.com/CVE-2021-3035 x_refsource_MISC