CVE-2021-28099

Description

In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.

Risk Information

Base Score

4.4

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.035

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-28099 are affected in Netflix - hollow 6.1.0	Windows
Vulnerabilities CVE-2021-28099 are affected in Netflix - hollow for Linux 6.1.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234