{"api_version":"1","generated_at":"2026-07-24T17:44:57+00:00","cve":"CVE-2021-41067","urls":{"html":"https://cve.report/CVE-2021-41067","api":"https://cve.report/api/cve/CVE-2021-41067.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-41067","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-41067"},"summary":{"title":"CVE-2021-41067","description":"An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation of update packages that can cause an installation of malicious content.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2021-12-14 16:15:00","updated_at":"2023-11-07 03:38:00"},"problem_types":["CWE-354"],"metrics":[],"references":[{"url":"https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e","name":"https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e","refsource":"","tags":[],"title":"exploiting Listary: Searching your way to SYSTEM privileges | by Tomer Peled | Dec, 2021 | Medium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://medium.com/@tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e","name":"https://medium.com/@tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e","refsource":"MISC","tags":[],"title":"exploiting Listary: Searching your way to SYSTEM privileges | by Tomer Peled | Dec, 2021 | Medium","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.listary.com/download","name":"https://www.listary.com/download","refsource":"MISC","tags":[],"title":"Listary Download Page – Listary","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41067","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41067","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"41067","vulnerable":"1","versionEndIncluding":"6","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"listary","cpe5":"listary","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2021-41067","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation of update packages that can cause an installation of malicious content."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://www.listary.com/download","refsource":"MISC","name":"https://www.listary.com/download"},{"refsource":"MISC","name":"https://medium.com/@tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e","url":"https://medium.com/@tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e"}]}},"nvd":{"publishedDate":"2021-12-14 16:15:00","lastModifiedDate":"2023-11-07 03:38:00","problem_types":["CWE-354"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:C/I:C/A:C","accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":7.6},"severity":"HIGH","exploitabilityScore":4.9,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:listary:listary:*:*:*:*:*:*:*:*","versionEndIncluding":"6","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"41067","Ordinal":"216839","Title":"CVE-2021-41067","CVE":"CVE-2021-41067","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"41067","Ordinal":"1","NoteData":"An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation of update packages that can cause an installation of malicious content.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"41067","Ordinal":"2","NoteData":"2021-12-14","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"41067","Ordinal":"3","NoteData":"2021-12-14","Type":"Other","Title":"Modified"}]}}}