Vulnerability · Published Nov 8, 2021 · Assigned by mitre
CVE-2021-42073
High 8.2
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Official description
An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-side implementation of Barrier) simply by supplying a client label that identifies a valid client configuration. This label is "Unnamed" by default but could instead be guessed from hostnames or other publicly available information. In the active session state, an attacker can capture input device events from the server, and also modify the clipboard content on the server.
Affected products (as reported)
References
- [oss-security] 20211102 Barrier "software KVM switch" multiple remote security issues mailing-list
- https://github.com/debauchee/barrier/releases/tag/v2.4.0
- https://github.com/debauchee/barrier/commit/b5adc93e2bd74cb094f91ff595c07f321a489f3e
- https://github.com/debauchee/barrier/commit/229abab99f39f11624e5651f819e7f1f8eddedcc