CVE-2021-36780 Unauthorized data access from replicas through vulnerable instance manager pods
Attackers can access Longhorn replica pods without authentication to read and write unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-36780?
CVE-2021-36780 is a high-severity missing authorization vulnerability in SUSE Longhorn, published on 17 Dec 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3v.
Weakness: CWE-306
Which versions are affected by CVE-2021-36780?
It affects 1 product.
Products include Linuxfoundation Longhorn.
How do I fix CVE-2021-36780?
No fix has been published for CVE-2021-36780 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-36780 being exploited?
There is no known exploitation of CVE-2021-36780 in the wild and no public exploit code.