Vulnerability · Published Jan 21, 2021 · Assigned by mitre

CVE-2021-3152

Medium 5.3

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)2.2%top 17.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Home Assistant does have a security update that is worthwhile in addressing this situation

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.home-assistant.io/blog/2021/01/14/security-bulletin/ x_refsource_CONFIRM
https://www.home-assistant.io/blog/2021/01/22/security-disclosure/ x_refsource_MISC