CVE-2021-31215 : SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows r

SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.

Published 2021-05-13 06:15:07

Updated 2022-03-31 16:55:39

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2021-31215

Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 33
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Matching versions
Schedmd » Slurm
Versions before (<) 20.02.7
cpe:2.3:a:schedmd:slurm:*:*:*:*:*:*:*:*
Matching versions
Schedmd » Slurm
Versions from including (>=) 20.11 and before (<) 20.11.7
cpe:2.3:a:schedmd:slurm:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-31215

EPSS FAQ

0.42%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 71 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-31215

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2021-31215

https://lists.debian.org/debian-lts-announce/2022/01/msg00011.html

[SECURITY] [DLA 2886-1] slurm-llnl security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ODMJQNY4FAV7G3DSKVIO5KY7Q7DKBPU/

[SECURITY] Fedora 34 Update: slurm-20.11.7-1.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://lists.schedmd.com/pipermail/slurm-announce/2021/000055.html

[slurm-announce] Slurm versions 20.11.7 and 20.02.7 are now available (CVE-2021-31215)
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PRHTASFAU5FNB2MJOG67YID2ONQS5MCQ/

[SECURITY] Fedora 33 Update: slurm-20.11.7-1.fc33 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://www.schedmd.com/news.php?id=248#OPT_248

News | SchedMD
Release Notes;Vendor Advisory

Jump to

Vulnerability Details : CVE-2021-31215

Products affected by CVE-2021-31215

Exploit prediction scoring system (EPSS) score for CVE-2021-31215

CVSS scores for CVE-2021-31215

References for CVE-2021-31215