Vulnerability Details : CVE-2021-26928
Potential exploit
BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which may, for example, include Tigera products in some configurations, as well as products of other vendors) may have been susceptible to route redirection for Denial of Service and/or Information Disclosure. NOTE: a researcher has asserted that the behavior is within Tigera’s area of responsibility; however, Tigera disagrees
Vulnerability category: Denial of serviceInformation leak
Products affected by CVE-2021-26928
- cpe:2.3:a:nic:bird:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-26928
0.33%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 54 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-26928
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.9
|
MEDIUM | AV:N/AC:M/Au:S/C:P/I:N/A:P |
6.8
|
4.9
|
NIST | |
|
6.8
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H |
1.6
|
5.2
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2024-07-03 |
|
6.8
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H |
1.6
|
5.2
|
NIST |
CWE ids for CVE-2021-26928
-
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2021-26928
-
https://www.cyberark.com/resources/threat-research-blog/attacking-kubernetes-clusters-through-your-network-plumbing-part-2
Attacking Kubernetes Clusters Through Your Network Plumbing: Part 2Exploit;Mitigation;Third Party Advisory
Jump to