CVE-2021-27285
Published: 06 January 2025
Description
An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands via /opt/tsce4/torque6/bin/getJobsByShell.
Security Summary
CVE-2021-27285 is a vulnerability discovered in Inspur ClusterEngine version 4.0. The issue enables attackers to escalate local privileges and execute arbitrary commands by targeting the /opt/tsce4/torque6/bin/getJobsByShell component. It is associated with CWE-276 and carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
A local attacker requires only local access to the system, with no privileges, low attack complexity, and no user interaction needed to exploit the vulnerability. Upon successful exploitation, the attacker can achieve privilege escalation, allowing execution of arbitrary commands with elevated permissions.
Mitigation details and further technical information, including potential patches or workarounds, are available in the referenced GitHub repository at https://github.com/fjh1997/CVE-2021-27285.
Details
- CWE(s)