{"api_version":"1","generated_at":"2026-07-23T14:39:48+00:00","cve":"CVE-2021-42559","urls":{"html":"https://cve.report/CVE-2021-42559","api":"https://cve.report/api/cve/CVE-2021-42559.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-42559","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-42559"},"summary":{"title":"CVE-2021-42559","description":"An issue was discovered in CALDERA 2.8.1. It contains multiple startup \"requirements\" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2022-01-12 20:15:00","updated_at":"2022-01-19 19:46:00"},"problem_types":["CWE-77"],"metrics":[],"references":[{"url":"https://github.com/mitre/caldera/releases","name":"https://github.com/mitre/caldera/releases","refsource":"MISC","tags":[],"title":"Releases · mitre/caldera · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42559-Command%20Injection%20Via%20Configurations-MITRE%20Caldera","name":"https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42559-Command%20Injection%20Via%20Configurations-MITRE%20Caldera","refsource":"MISC","tags":[],"title":"Disclosures/CVE-2021-42559-Command Injection Via Configurations-MITRE Caldera at master · DrunkenShells/Disclosures · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42559","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42559","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"42559","vulnerable":"1","versionEndIncluding":"2.8.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mitre","cpe5":"caldera","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2021-42559","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in CALDERA 2.8.1. It contains multiple startup \"requirements\" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://github.com/mitre/caldera/releases","refsource":"MISC","name":"https://github.com/mitre/caldera/releases"},{"refsource":"MISC","name":"https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42559-Command%20Injection%20Via%20Configurations-MITRE%20Caldera","url":"https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-42559-Command%20Injection%20Via%20Configurations-MITRE%20Caldera"}]}},"nvd":{"publishedDate":"2022-01-12 20:15:00","lastModifiedDate":"2022-01-19 19:46:00","problem_types":["CWE-77"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mitre:caldera:*:*:*:*:*:*:*:*","versionEndIncluding":"2.8.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"42559","Ordinal":"219052","Title":"CVE-2021-42559","CVE":"CVE-2021-42559","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"42559","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}