Vulnerability · Published May 16, 2022 · Assigned by mitre
CVE-2021-33318
Critical 9.8
In plain English
A critical-severity security flaw in the ipmatcher package (NuGet). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.1%top 18.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (WatsonWebserver) due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | ipmatcher | 1.0.4.2 | GHSA-qj93-37f5-mr29 |
Affected products (as reported)
References
- https://github.com/jchristn/IpMatcher x_refsource_MISC
- https://github.com/jchristn/WatsonWebserver x_refsource_MISC
- https://github.com/kaoudis/advisories/blob/main/0-2021.md x_refsource_MISC
- https://github.com/jchristn/IpMatcher/commit/81d77c2f33aa912dbd032b34b9e184fc6e041d89 x_refsource_MISC