CVE-2021-21979
What it is
In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker image bitnami/laravel was built, and the value of APP_KEY is fixed under certain conditions. This value is crucial for the security of the application and must be randomly generated per Laravel installation. If your application's encryption key is in the hands of a malicious party, that party could craft cookie values using the encryption key and exploit vulnerabilities inherent to PHP object serialization / unserialization, such as calling arbitrary class methods within your application.
At a glance
- Exploitability
- Can be exploited over the network without logging in. Limited direct impact.
- Exploit odds
- 0.6% chance of exploitation in the next 30 days (EPSS).
- Fix
- No patch or advisory is linked yet. Look at mitigations or restrict exposure.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 0.6% in the next 30 days (EPSS).
- Severity: 7.3 HIGH (CVSS).
- Fix: none linked yet, which raises it.
Details
- Published
- Last modified
- Exploit probability
- 0.6% · EPSS, next 30 days
- Weakness
- CWE-798 · Hard-coded credentials
- Record status
- Modified
Affected
- Bitnami Containers ≤ 6.0.2-debian-9-r22
- Bitnami Containers ≤ 6.4.0-debian-9-r31
- Bitnami Containers ≤ 6.5.2-debian-9-r20
- Bitnami Containers ≤ 6.8.0-debian-9-r26
- Bitnami Containers ≤ 6.12.0-debian-10-r33
- Bitnami Containers ≤ 6.18.0-debian-10-r21
- Bitnami Containers ≤ 6.18.3-debian-10-r22
- Bitnami Containers ≤ 6.18.8-debian-10-r110
Attack profile CVSS 3.1 · 7.3
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2021-21979.md and follow it. Check whether this project is affected by CVE-2021-21979. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
