Vulnerability · Published Mar 23, 2021 · Assigned by netflix
CVE-2021-28099
Medium 4.4
In plain English
A medium-severity security flaw in Netflix OSS Hollow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS NVD)4.4Medium
Exploit odds (30 days)0.3%top 83.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.netflix.hollow:hollow | no fix listed | GHSA-9295-mhf3-v33m |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Netflix OSS Hollow | All versions |