misp-circl-feed/feeds/circl/misp/ffea72a3-7935-4078-b769-b872475c5eae.json

7094 lines
305 KiB
JSON
Raw Permalink Normal View History

2024-12-27 11:52:46 +01:00
{
"Event": {
"analysis": "2",
"date": "2024-11-27",
"extends_uuid": "",
"info": "OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions",
"publish_timestamp": "1732698657",
"published": true,
"threat_level_id": "3",
"timestamp": "1732697965",
"uuid": "ffea72a3-7935-4078-b769-b872475c5eae",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#004646",
"local": false,
"name": "type:OSINT",
"relationship_type": ""
},
{
"colour": "#0071c3",
"local": false,
"name": "osint:lifetime=\"perpetual\"",
"relationship_type": ""
},
{
"colour": "#0087e8",
"local": false,
"name": "osint:certainty=\"50\"",
"relationship_type": ""
},
{
"colour": "#ffffff",
"local": false,
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#ffffff",
"local": false,
"name": "tlp:clear",
"relationship_type": ""
},
{
"colour": "#362ef9",
"local": false,
"name": "misp-galaxy:country=\"afghanistan\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"brazil\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"eswatini\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"india\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"indonesia\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"malaysia\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"pakistan\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"philippines\"",
"relationship_type": "targets"
},
{
"colour": "#c05590",
"local": false,
"name": "misp-galaxy:country=\"south africa\"",
"relationship_type": "targets"
},
{
"colour": "#1237d4",
"local": false,
"name": "misp-galaxy:country=\"taiwan\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"thailand\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"united states of america\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"vietnam\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:threat-actor=\"Earth Estries\"",
"relationship_type": "attributed-to"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:sector=\"Consulting\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:sector=\"Managed Services Provider\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:sector=\"NGO\"",
"relationship_type": "targets"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:sector=\"Telecoms\"",
"relationship_type": "targets"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696101",
"to_ids": false,
"type": "vulnerability",
"uuid": "831c04b8-68ed-4d71-bfa3-52eaa58ce4d8",
"value": "CVE-2023-46805"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696101",
"to_ids": false,
"type": "vulnerability",
"uuid": "dd05a57a-ed94-4a99-b95f-b6d8a835fa31",
"value": "CVE-2024-21887"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696101",
"to_ids": false,
"type": "vulnerability",
"uuid": "5596e6e9-b906-4ef4-9831-09226e134d28",
"value": "CVE-2023-48788"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696101",
"to_ids": false,
"type": "vulnerability",
"uuid": "e6b7864e-38e0-43a5-ac25-051beb63506c",
"value": "CVE-2022-3236"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696101",
"to_ids": false,
"type": "vulnerability",
"uuid": "669b4001-f63d-4bdf-b9e2-4fb86abba5df",
"value": "CVE-2021-26855"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696101",
"to_ids": false,
"type": "vulnerability",
"uuid": "df48cd61-c020-49f9-82a2-e0a798183068",
"value": "CVE-2021-26857"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696101",
"to_ids": false,
"type": "vulnerability",
"uuid": "67d93fff-c91c-41d1-89b2-dced25d651a5",
"value": "CVE-2021-26858"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696101",
"to_ids": false,
"type": "vulnerability",
"uuid": "a66dce6e-a6ff-4146-9d6a-5d7ffd4b5737",
"value": "CVE-2021-27065"
},
{
"category": "Network activity",
"comment": "Campaign Beta (GHOSTSPIDER)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696623",
"to_ids": true,
"type": "ip-dst",
"uuid": "b07e0aa5-d18d-4a91-9e5e-dadb887c88be",
"value": "139.59.108.43"
},
{
"category": "Network activity",
"comment": "Campaign Beta (GHOSTSPIDER)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696623",
"to_ids": true,
"type": "ip-dst",
"uuid": "a0eeaf5e-f029-427c-931c-c6a22854a6f6",
"value": "185.105.1.243"
},
{
"category": "Network activity",
"comment": "Campaign Beta (GHOSTSPIDER)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696623",
"to_ids": true,
"type": "ip-dst",
"uuid": "5df65d1e-050c-472c-a95e-6e52e600b2df",
"value": "143.198.92.175"
},
{
"category": "Network activity",
"comment": "Campaign Beta (GHOSTSPIDER)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696623",
"to_ids": true,
"type": "ip-dst",
"uuid": "744b3c19-afcd-4637-95d6-0852576acef9",
"value": "139.99.114.108"
},
{
"category": "Network activity",
"comment": "Campaign Beta (GHOSTSPIDER)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696623",
"to_ids": true,
"type": "ip-dst",
"uuid": "f324d9f7-99c6-44ff-90e1-22411a9bae4f",
"value": "139.59.236.31"
},
{
"category": "Network activity",
"comment": "Campaign Beta (GHOSTSPIDER)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696623",
"to_ids": true,
"type": "ip-dst",
"uuid": "64275dd4-6a4a-446d-af02-822574e7e6c3",
"value": "104.194.153.65"
},
{
"category": "Network activity",
"comment": "Campaign Beta (DEMODEX)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696644",
"to_ids": true,
"type": "ip-dst",
"uuid": "fbebda1d-3710-41b7-9af6-8ea87dfc2e64",
"value": "45.125.67.144"
},
{
"category": "Network activity",
"comment": "Campaign Beta (DEMODEX)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696644",
"to_ids": true,
"type": "ip-dst",
"uuid": "5e37d0a2-2c7a-4419-8936-0acab03a32c2",
"value": "43.226.126.164"
},
{
"category": "Network activity",
"comment": "Campaign Beta (DEMODEX)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696644",
"to_ids": true,
"type": "ip-dst",
"uuid": "6ac0a2e8-c12e-4bf9-94d8-dc1eaa016c53",
"value": "172.93.165.10"
},
{
"category": "Network activity",
"comment": "Campaign Beta (DEMODEX)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696644",
"to_ids": true,
"type": "ip-dst",
"uuid": "3509a3db-b2df-4801-838e-d4bc72994cda",
"value": "193.239.86.168"
},
{
"category": "Network activity",
"comment": "Campaign Beta (DEMODEX)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696644",
"to_ids": true,
"type": "ip-dst",
"uuid": "0e0b23e7-eb09-440d-89d7-20496b8b6828",
"value": "146.70.79.18"
},
{
"category": "Network activity",
"comment": "Campaign Beta (DEMODEX)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696644",
"to_ids": true,
"type": "ip-dst",
"uuid": "78c0410e-d99b-4a79-ba3d-8d431125fa5e",
"value": "146.70.79.105"
},
{
"category": "Network activity",
"comment": "Campaign Beta (DEMODEX)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696644",
"to_ids": true,
"type": "ip-dst",
"uuid": "ad898f63-b2f1-4863-8d51-dd8d289fe14c",
"value": "205.189.160.3"
},
{
"category": "Network activity",
"comment": "Campaign Beta (DEMODEX)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696644",
"to_ids": true,
"type": "ip-dst",
"uuid": "ecf727ea-f971-4dca-acaf-825667465fc8",
"value": "96.9.211.27"
},
{
"category": "Network activity",
"comment": "Campaign Beta (DEMODEX)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696644",
"to_ids": true,
"type": "ip-dst",
"uuid": "cc4a4511-4972-4faa-b269-1978e46a28c5",
"value": "43.226.126.165"
},
{
"category": "Network activity",
"comment": "Campaign Alpha (related C&C)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696692",
"to_ids": true,
"type": "ip-dst",
"uuid": "7c7a26ec-9b9f-4f6f-916a-c7d0e3842ebc",
"value": "103.75.190.73"
},
{
"category": "Network activity",
"comment": "Campaign Alpha (related C&C)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696692",
"to_ids": true,
"type": "ip-dst",
"uuid": "61ae0a0b-bc83-4e96-b144-581f43b90877",
"value": "172.93.165.14"
},
{
"category": "Network activity",
"comment": "Campaign Alpha (SNAPPYBEE)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696720",
"to_ids": true,
"type": "ip-dst",
"uuid": "7df6b10f-0984-445e-8ec6-88c1d5467e07",
"value": "91.245.253.27"
},
{
"category": "Network activity",
"comment": "Campaign Alpha (SNAPPYBEE)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696720",
"to_ids": true,
"type": "ip-dst",
"uuid": "051363d5-c2c5-467d-a48c-d2ba6c93b56d",
"value": "158.247.222.165"
},
{
"category": "Network activity",
"comment": "Campaign Alpha (Open directory C&C)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696865",
"to_ids": true,
"type": "ip-dst",
"uuid": "c6bad4e2-3049-4d96-9fe8-284f2f671c9f",
"value": "23.81.41.166"
},
{
"category": "Network activity",
"comment": "Campaign Alpha (frpc)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696885",
"to_ids": true,
"type": "ip-dst",
"uuid": "792efa82-74b0-4604-85cf-879224d10be4",
"value": "165.154.227.192"
},
{
"category": "Network activity",
"comment": "Campaign Alpha (DEMODEX)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1732696908",
"to_ids": true,
"type": "ip-dst",
"uuid": "2ad05ad6-5baa-4525-9d3d-c6fb164acb2b",
"value": "103.91.64.214"
}
],
"Object": [
{
"comment": "",
"deleted": false,
"description": "Report object to describe a report along with its metadata.",
"meta-category": "misc",
"name": "report",
"template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
"template_version": "8",
"timestamp": "1732695669",
"uuid": "ded8856b-f754-4b8a-a137-9042433c49b9",
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "link",
"timestamp": "1732695669",
"to_ids": false,
"type": "link",
"uuid": "12509bbd-6a44-4cc2-8c9e-dcd3eb16d482",
"value": "https://www.trendmicro.com/en_us/research/24/k/earth-estries.html"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732695669",
"to_ids": false,
"type": "text",
"uuid": "876b9222-4866-4f06-a5b4-6a017f9df1c8",
"value": "- Earth Estries, a Chinese APT group, has primarily targeted critical sectors like telecommunications and government entities across the US, Asia-Pacific, Middle East, and South Africa since 2023.\r\n- The group employs advanced attack techniques and multiple backdoors, such as GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, affecting several Southeast Asian telecommunications companies and government entities.\r\n- Earth Estries exploits public-facing server vulnerabilities to establish initial access and uses living-off-the-land binaries for lateral movement within networks to deploy malware and conduct long-term espionage.\r\n- The group has compromised over 20 organizations, targeting various sectors including telecommunications, technology, consulting, chemical, and transportation industries, as well as government agencies and NGOs in numerous countries.\r\n\r\n- Earth Estries uses a complex C&C infrastructure managed by different teams, and their operations often overlap with TTPs of other known Chinese APT groups, indicating possible use of shared tools from malware-as-a-service providers"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "title",
"timestamp": "1732695669",
"to_ids": false,
"type": "text",
"uuid": "3e65a453-646d-4db8-94af-0661c8e3f34d",
"value": "Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1732695669",
"to_ids": false,
"type": "text",
"uuid": "41e4fb2d-59a6-406d-8ae6-c71e0b00a363",
"value": "Blog"
}
]
},
{
"comment": "CVE-2021-27065: Enriched via the cve_advanced module",
"deleted": false,
"description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
"meta-category": "vulnerability",
"name": "vulnerability",
"template_uuid": "81650945-f186-437b-8945-9f31715d32da",
"template_version": "8",
"timestamp": "1732696162",
"uuid": "598166cf-5511-49b0-b406-0754e6ab2440",
"ObjectReference": [
{
"comment": "",
"object_uuid": "598166cf-5511-49b0-b406-0754e6ab2440",
"referenced_uuid": "a66dce6e-a6ff-4146-9d6a-5d7ffd4b5737",
"relationship_type": "related-to",
"timestamp": "1732696164",
"uuid": "a71111cd-1401-419c-939c-182f13ddb183"
},
{
"comment": "",
"object_uuid": "598166cf-5511-49b0-b406-0754e6ab2440",
"referenced_uuid": "0691345e-b820-496f-b054-562fef233a3d",
"relationship_type": "weakened-by",
"timestamp": "1732696164",
"uuid": "c2544b8a-4b3b-4429-9053-e67c8e42d758"
},
{
"comment": "",
"object_uuid": "598166cf-5511-49b0-b406-0754e6ab2440",
"referenced_uuid": "df3f8d43-4697-44cb-acf0-0bf24c1f73ed",
"relationship_type": "targeted-by",
"timestamp": "1732696164",
"uuid": "a1aa4946-8436-48bb-b1b0-753d4a23a31b"
},
{
"comment": "",
"object_uuid": "598166cf-5511-49b0-b406-0754e6ab2440",
"referenced_uuid": "5342f955-30a8-496a-97b7-52c7904b4ab4",
"relationship_type": "targeted-by",
"timestamp": "1732696164",
"uuid": "e3afb1f1-99fa-4927-841f-6362779acc3f"
},
{
"comment": "",
"object_uuid": "598166cf-5511-49b0-b406-0754e6ab2440",
"referenced_uuid": "5a1ed979-35ef-4e2d-a9bb-1551f2a52928",
"relationship_type": "targeted-by",
"timestamp": "1732696164",
"uuid": "b8117579-e9a8-468b-80ea-d566e9e3fb23"
},
{
"comment": "",
"object_uuid": "598166cf-5511-49b0-b406-0754e6ab2440",
"referenced_uuid": "2ba27d93-0df1-46b0-ba6a-ed8cfe29bd96",
"relationship_type": "targeted-by",
"timestamp": "1732696164",
"uuid": "e51cdf6c-5128-453a-9351-a19153947a6c"
},
{
"comment": "",
"object_uuid": "598166cf-5511-49b0-b406-0754e6ab2440",
"referenced_uuid": "ee77a247-d203-47ad-9e73-537a21646276",
"relationship_type": "targeted-by",
"timestamp": "1732696164",
"uuid": "108242d9-58b5-41ca-9527-73468c933a7f"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696162",
"to_ids": false,
"type": "vulnerability",
"uuid": "b9d8aabb-212f-474f-83ea-f4fae2408bff",
"value": "CVE-2021-27065"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696162",
"to_ids": false,
"type": "text",
"uuid": "7e6e44b4-7155-4214-961c-9af105ed13b7",
"value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "modified",
"timestamp": "1732696162",
"to_ids": false,
"type": "datetime",
"uuid": "6d77ff47-89f5-4ab0-9d71-bf59302cc82f",
"value": "2024-07-25T17:34:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-score",
"timestamp": "1732696162",
"to_ids": false,
"type": "float",
"uuid": "959ab161-6e95-49d8-a4b5-ea803f595e6c",
"value": "7.8"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-string",
"timestamp": "1732696162",
"to_ids": false,
"type": "text",
"uuid": "f1994439-9533-4a3d-aa9f-1ff5a47a4ddf",
"value": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "published",
"timestamp": "1732696162",
"to_ids": false,
"type": "datetime",
"uuid": "f75adfa6-459e-45c1-8bc6-698b9fc8658b",
"value": "2021-03-03T00:15:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1732696162",
"to_ids": false,
"type": "text",
"uuid": "c0de8db0-755d-46e4-bf33-5684931c8ba0",
"value": "Published"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "3d82f58d-4e1c-4af6-b394-5b426fbe3278",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "f5ebf3b5-e6fa-42aa-ad42-991441c7bdd0",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "0790d1e9-295b-4c90-be12-7a8473a075d2",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "48e5a8fe-ff30-459f-9c5f-087feeae71c0",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "ee285439-0d67-4411-bd21-b6c50eb97aa5",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "67b36ffb-5187-4917-a8ad-f89dd0ada3a9",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "ba5741c9-d1bd-4b6e-9033-709c2acc8c22",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "4331459b-64b7-4655-92d6-9df83bf83053",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "11dc346f-3eaa-49d2-90ef-54eed58db35d",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "509112a9-0ba2-49ed-a44d-e28dba8a8ef5",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "7032968e-6dba-4e6c-9ec6-12087ac8f416",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "f8b4acd4-979f-4f52-9902-ca7012f44c8e",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "d4de8a19-2627-42ee-8c19-f2aa1d3f7b15",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "f4e99779-af1e-41c5-8d5d-8add657ce482",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "b28bcdbd-698a-456a-abf8-8581b2bda6d1",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "47084170-82a0-4687-9632-bfe1f9a1abdc",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "19cc66c9-2d9f-4aea-b3a9-d3c6bc72b7a3",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "079ee8af-3652-4503-bcf2-d139c6dcfa22",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "c5246da9-ed54-4dcf-af5d-b8cb2e4927f6",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "ac2048b8-383f-411d-ac71-18ea0fce4fc4",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "63fc5cea-7dd3-4bc8-ac05-a6117329bc41",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696162",
"to_ids": false,
"type": "cpe",
"uuid": "47fbb094-ac91-4ff7-822e-614aac364459",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696162",
"to_ids": false,
"type": "link",
"uuid": "633e2114-8eec-4b9a-ae52-4a6be019101e",
"value": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27065"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696162",
"to_ids": false,
"type": "link",
"uuid": "b2a832e4-f58c-4de4-b6ac-bcde7e3ec6c4",
"value": "http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696162",
"to_ids": false,
"type": "link",
"uuid": "e0a41bfa-aaa9-4298-af37-21460bfcac81",
"value": "http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html"
}
]
},
{
"comment": "CVE-2021-27065: Enriched via the cve_advanced module",
"deleted": false,
"description": "Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.",
"meta-category": "vulnerability",
"name": "weakness",
"template_uuid": "b8713fc0-d7a2-4b27-a182-38ed47966802",
"template_version": "1",
"timestamp": "1732696162",
"uuid": "0691345e-b820-496f-b054-562fef233a3d",
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696162",
"to_ids": false,
"type": "weakness",
"uuid": "bbfb9f29-82d2-43d5-af30-1466297c00c8",
"value": "CWE-22"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696162",
"to_ids": false,
"type": "text",
"uuid": "937828b2-7918-4a51-b81a-ebe8fe29d197",
"value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "status",
"timestamp": "1732696162",
"to_ids": false,
"type": "text",
"uuid": "90f4cf83-295b-4fd3-a981-0d4e9e5cdff8",
"value": "Stable"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "weakness-abs",
"timestamp": "1732696162",
"to_ids": false,
"type": "text",
"uuid": "f5dfa803-a024-4d28-9ad8-f47c03fe9b9a",
"value": "Base"
}
]
},
{
"comment": "CVE-2021-27065: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696162",
"uuid": "df3f8d43-4697-44cb-acf0-0bf24c1f73ed",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696162",
"to_ids": false,
"type": "text",
"uuid": "d9e70df4-d5c2-4e6d-96db-af473a689d56",
"value": "76"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696162",
"to_ids": false,
"type": "text",
"uuid": "60a09b68-5f0d-4d19-bf9e-b1d88a784be0",
"value": "Manipulating Web Input to File System Calls"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696162",
"to_ids": false,
"type": "text",
"uuid": "797e7be7-2f1e-432d-abc3-c82f576ba8a9",
"value": "An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696162",
"to_ids": false,
"type": "text",
"uuid": "b33ac4ad-5e29-4276-9110-32ae90f6f04b",
"value": "Program must allow for user controlled variables to be applied directly to the filesystem"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "e17fe8ab-4e60-4568-aa4e-e22242e2460c",
"value": "Design: Enforce principle of least privilege. Design: Ensure all input is validated, and does not contain file system commands Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands. Design: For interactive user applications, consider if direct file system interface is necessary, instead consider having the application proxy communication. Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "0598251b-4a55-425c-977f-89666d91648f",
"value": "CWE-15"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "e06580ef-27af-4a7c-9207-0b397492a4ec",
"value": "CWE-22"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "59210703-adf6-49c6-9806-818d2cb7a16e",
"value": "CWE-23"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "bb72d156-915c-429c-b357-61769d549cf9",
"value": "CWE-264"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "a60aa065-a7b3-4220-a7f4-23042de69642",
"value": "CWE-272"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "b2038306-4691-4cf3-b76a-e406daac54e0",
"value": "CWE-285"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "c61ffca3-6a48-4d47-ad97-e9961d6c7950",
"value": "CWE-346"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "00269532-5605-4cad-b4a3-86f07da0fe01",
"value": "CWE-348"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "a89aa33b-ceae-42ae-8085-d75a3cb84926",
"value": "CWE-59"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "7769c96a-bb32-49e1-bde1-fd3712720b83",
"value": "CWE-715"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "6164f45d-ca89-4a50-8de2-e07c8ed8d1d1",
"value": "CWE-73"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "dee9676f-7c1e-467e-b6d0-a5341a10076c",
"value": "CWE-74"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "70514029-351a-4950-9fed-119d49f188cb",
"value": "CWE-77"
}
]
},
{
"comment": "CVE-2021-27065: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696163",
"uuid": "5342f955-30a8-496a-97b7-52c7904b4ab4",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "53859784-aae4-4696-88a7-56a848ad886c",
"value": "78"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "b31fab19-9bcc-412e-8456-6a21afd06551",
"value": "Using Escaped Slashes in Alternate Encoding"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "7ff256fb-30b0-422f-a17d-0790634c8000",
"value": "This attack targets the use of the backslash in alternate encoding. An attacker can provide a backslash as a leading character and causes a parser to believe that the next character is special. This is called an escape. By using that trick, the attacker tries to exploit alternate ways to encode the same character which leads to filter problems and opens avenues to attack."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "86ab0dd0-237d-40d3-a9cb-66161c58c4ba",
"value": "The application accepts the backlash character as escape character. The application server does incomplete input data decoding, filtering and validation."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "37aeceb2-5260-445b-859a-5d29cfa7146f",
"value": "Verify that the user-supplied data does not use backslash character to escape malicious characters. Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Be aware of the threat of alternative method of data encoding. Regular expressions can be used to filter out backslash. Make sure you decode before filtering and validating the untrusted input data. In the case of path traversals, use the principle of least privilege when determining access rights to file systems. Do not allow users to access directories/files that they should not access. Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process. Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "19db6e80-dfaf-446e-b5dc-0f0689f87fd5",
"value": "CWE-171"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "6a590bd5-a896-41c2-9738-877aab51853d",
"value": "CWE-172"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "7df49d8e-a19b-41c1-b0e7-43c80be9e989",
"value": "CWE-173"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "fa7ab328-df27-4971-ae4a-e3c4fe0b7d16",
"value": "CWE-180"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "ed62352b-7830-4a21-92bd-414cf4216e51",
"value": "CWE-181"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "36f7ff11-0c18-4d9e-97e2-885789f85ac3",
"value": "CWE-20"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "767aedca-22fb-4c93-a71d-1806b1053134",
"value": "CWE-21"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "07ec31c8-9465-4330-a488-79ec39831127",
"value": "CWE-22"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "53f546a1-d980-4ecb-bb18-fd38e41bd4da",
"value": "CWE-697"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "55bdfd7a-5732-4934-a909-71f82acaf728",
"value": "CWE-707"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "af932a9b-5a27-49f2-8bd3-e1cd9eb20f20",
"value": "CWE-73"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "80d72661-b5f6-4c52-b53f-b0d8c0aa0803",
"value": "CWE-74"
}
]
},
{
"comment": "CVE-2021-27065: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696163",
"uuid": "5a1ed979-35ef-4e2d-a9bb-1551f2a52928",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "873125ec-1f44-4897-a587-3bed81ff353b",
"value": "126"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "7450cf18-0c7a-467c-a30e-7bdfa5ae57e7",
"value": "Path Traversal"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "b2a09881-5b36-407e-9922-325160bab64d",
"value": "An adversary uses path manipulation methods to exploit insufficient input validation of a target to obtain access to data that should be not be retrievable by ordinary well-formed requests. A typical variety of this attack involves specifying a path to a desired file together with dot-dot-slash characters, resulting in the file access API or function traversing out of the intended directory structure and into the root file system. By replacing or modifying the expected path information the access function or API retrieves the file desired by the attacker. These attacks either involve the attacker providing a complete path to a targeted file or using control characters (e.g. path separators (/ or \\) and/or dots (.)) to reach desired directories or files."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "f467d1d1-a9c4-47f8-80f0-888bff2b36fa",
"value": "The attacker must be able to control the path that is requested of the target. The target must fail to adequately sanitize incoming paths"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "22d6c195-5117-4023-becb-9c5a66728c41",
"value": "Design: Configure the access control correctly. Design: Enforce principle of least privilege. Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing with limited privileges to protect against remote execution. Design: Input validation. Assume that user inputs are malicious. Utilize strict type, character, and encoding enforcement. Design: Proxy communication to host, so that communications are terminated at the proxy, sanitizing the requests before forwarding to server host. Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands. Implementation: Host integrity monitoring for critical files, directories, and processes. The goal of host integrity monitoring is to be aware when a security issue has occurred so that incident response and other forensic activities can begin. Implementation: Perform input validation for all remote content, including remote and user-generated content. Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables. Implementation: Use indirect references rather than actual file names. Implementation: Use possible permissions on file access when developing and deploying web applications. Implementation: Validate user input by only accepting known good. Ensure all content that is delivered to client is sanitized against an acceptable content specification -- using an allowlist approach."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "d91d55b4-08f0-4c50-aa00-f9e8e99327a6",
"value": "CWE-22"
}
]
},
{
"comment": "CVE-2021-27065: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696163",
"uuid": "2ba27d93-0df1-46b0-ba6a-ed8cfe29bd96",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "6c8a86f1-39fc-47a0-b93d-32106f8c67b9",
"value": "64"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "b64ddf9c-f8e0-450c-ac27-a1b97095e51f",
"value": "Using Slashes and URL Encoding Combined to Bypass Validation Logic"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "479334fd-94bb-4000-8798-031c4eb91c2f",
"value": "This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple ways of encoding a URL and abuse the interpretation of the URL. A URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "478787d9-5341-4b0d-b4c8-f52df043e08b",
"value": "The application accepts and decodes URL string request. The application performs insufficient filtering/canonicalization on the URLs."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696163",
"to_ids": false,
"type": "text",
"uuid": "53ed7e69-a5d6-4cd5-b36d-fb5b1f6259f5",
"value": "Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system. Test your decoding process against malicious input. Be aware of the threat of alternative method of data encoding and obfuscation technique such as IP address encoding. When client input is required from web-based forms, avoid using the \"GET\" method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use the \"POST method whenever possible. Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process. Refer to the RFCs to safely decode URL. Regular expression can be used to match safe URL patterns. However, that may discard valid URL requests if the regular expression is too restrictive. There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http://www.microsoft.com/technet/security/tools/urlscan.mspx)."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "f14d9f6e-cdb4-4470-a838-c151eb59f168",
"value": "CWE-171"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "baa26d52-bfdd-473c-85b5-9f0f4d7f83e1",
"value": "CWE-172"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696163",
"to_ids": false,
"type": "weakness",
"uuid": "435fe005-9b7a-44d0-829d-d441c22ea24a",
"value": "CWE-173"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "8b0ed090-3425-4044-bfdf-1f781e788e82",
"value": "CWE-177"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "c4fd8c83-eaf3-4041-b475-a89f62d68260",
"value": "CWE-20"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "bc1e644f-2e98-48d4-b190-77663973cbfc",
"value": "CWE-21"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "a83140aa-cef8-4d0b-ba96-5cd0b98e13da",
"value": "CWE-22"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "35fe8078-3d05-42a5-b965-00cdd6d375a3",
"value": "CWE-697"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "e10e68fd-af72-422b-bb9e-53173bc3452f",
"value": "CWE-707"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "a1b78e2e-9ac5-4f24-abe1-d8267f90e5ab",
"value": "CWE-73"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "84d3835d-55fa-4129-95e2-1b50884c1647",
"value": "CWE-74"
}
]
},
{
"comment": "CVE-2021-27065: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696164",
"uuid": "ee77a247-d203-47ad-9e73-537a21646276",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696164",
"to_ids": false,
"type": "text",
"uuid": "26203d36-77c5-4107-8fa4-b3aa0282a8f3",
"value": "79"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696164",
"to_ids": false,
"type": "text",
"uuid": "817bef80-818e-4978-b9c4-1b4b43d08a98",
"value": "Using Slashes in Alternate Encoding"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696164",
"to_ids": false,
"type": "text",
"uuid": "223f6601-5731-4454-b46a-b9589f42163d",
"value": "This attack targets the encoding of the Slash characters. An attacker would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the attacker many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696164",
"to_ids": false,
"type": "text",
"uuid": "7b06e124-7ddb-456e-a01f-98df13b23ef4",
"value": "The application server accepts paths to locate resources. The application server does insufficient input data validation on the resource path requested by the user. The access right to resources are not set properly."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696164",
"to_ids": false,
"type": "text",
"uuid": "15b3c576-a98e-4a75-8a57-9ee1e9833e88",
"value": "Any security checks should occur after the data has been decoded and validated as correct data format. Do not repeat decoding process, if bad character are left after decoding process, treat the data as suspicious, and fail the validation process. Refer to the RFCs to safely decode URL. When client input is required from web-based forms, avoid using the \"GET\" method to submit data, as the method causes the form data to be appended to the URL and is easily manipulated. Instead, use the \"POST method whenever possible. There are tools to scan HTTP requests to the server for valid URL such as URLScan from Microsoft (http://www.microsoft.com/technet/security/tools/urlscan.mspx) Be aware of the threat of alternative method of data encoding and obfuscation technique such as IP address encoding. (See related guideline section) Test your path decoding process against malicious input. In the case of path traversals, use the principle of least privilege when determining access rights to file systems. Do not allow users to access directories/files that they should not access. Assume all input is malicious. Create an allowlist that defines all valid input to the application based on the requirements specifications. Input that does not match against the allowlist should not be permitted to enter into the system."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "d43ff180-a048-46ec-bb56-488e39894e1c",
"value": "CWE-171"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "b5b40184-622f-47de-8f1f-78ea1f699480",
"value": "CWE-173"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "c099a59b-9b18-4538-9f93-ed19cd966db4",
"value": "CWE-180"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "1f033ee6-65ac-43a4-806d-2c106585894b",
"value": "CWE-181"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "82e319fe-1b14-4179-ad77-fb0cddc3d53d",
"value": "CWE-185"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "623a1c65-be54-4522-a95b-c696bf7e1036",
"value": "CWE-20"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "3f034bce-f6b3-4dd9-bdf3-61b7650afb12",
"value": "CWE-200"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "f6fae2ef-a0ab-4e3d-8530-a21158c86210",
"value": "CWE-21"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "1a3547bd-9c78-48b2-ba62-077a7ecb3dba",
"value": "CWE-22"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "d0314af1-bd48-4284-83cb-3021cf74e0e6",
"value": "CWE-697"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "aec7d949-ee0e-45f9-825a-6d20590f5dfd",
"value": "CWE-707"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "376f7bfb-c988-4a69-aa61-24329843ffc4",
"value": "CWE-73"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696164",
"to_ids": false,
"type": "weakness",
"uuid": "04110554-8661-4831-9944-b433274425c5",
"value": "CWE-74"
}
]
},
{
"comment": "CVE-2021-26858: Enriched via the cve_advanced module",
"deleted": false,
"description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
"meta-category": "vulnerability",
"name": "vulnerability",
"template_uuid": "81650945-f186-437b-8945-9f31715d32da",
"template_version": "8",
"timestamp": "1732696179",
"uuid": "307fab05-6e48-4d29-aa58-b4ef8ed9d0de",
"ObjectReference": [
{
"comment": "",
"object_uuid": "307fab05-6e48-4d29-aa58-b4ef8ed9d0de",
"referenced_uuid": "67d93fff-c91c-41d1-89b2-dced25d651a5",
"relationship_type": "related-to",
"timestamp": "1732696180",
"uuid": "3257620e-9917-4c29-97b9-653cd2aa73d8"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696179",
"to_ids": false,
"type": "vulnerability",
"uuid": "dd219cce-eb22-46ff-afaf-6e8f0565e76b",
"value": "CVE-2021-26858"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696179",
"to_ids": false,
"type": "text",
"uuid": "27a7882f-854e-4262-b396-3d452f61c898",
"value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "modified",
"timestamp": "1732696179",
"to_ids": false,
"type": "datetime",
"uuid": "e259f38a-6697-4682-9c8a-db70ac59a363",
"value": "2024-07-25T17:53:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-score",
"timestamp": "1732696179",
"to_ids": false,
"type": "float",
"uuid": "fc5b8b10-70ff-4713-a17f-2405dff28a8b",
"value": "7.8"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-string",
"timestamp": "1732696179",
"to_ids": false,
"type": "text",
"uuid": "103bf58b-8893-4dcb-9818-e1c8c15e9978",
"value": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "published",
"timestamp": "1732696179",
"to_ids": false,
"type": "datetime",
"uuid": "d9955904-7ff9-486e-847b-cf443f19ffe2",
"value": "2021-03-03T00:15:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1732696179",
"to_ids": false,
"type": "text",
"uuid": "87d455a1-d547-42ff-a614-e8d32b97acc1",
"value": "Published"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "53cf2218-6de3-4ed6-aeb1-ce7b1e20e5e5",
"value": "cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "858d90ad-a1ff-4f41-98e1-b0ae8b75b51f",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "26eda3a3-8cd8-4556-a93b-dcad2632e478",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "605f6645-13dd-464d-9853-416208c3a67b",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "81359cb1-4590-4f06-b36d-7ff9f3a52c2e",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "03137122-b001-4f19-ae3e-41f2f368802a",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "0846ebbf-846c-412e-a953-440dab14f396",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "02a9f2c9-8408-4d23-b1cd-a6255f2a6d53",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "61021e1e-a9b1-4e75-bcf2-f9710830e366",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "c0232508-4908-4030-aebe-a55680e0ea9c",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "11dce5eb-5b3a-41b0-8c99-e7d25ccd21a6",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "2fe85801-c506-4cf5-9907-ea18cace47e8",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "aa8b5d37-ad87-42f5-a254-98aba74a8914",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "f0a5a5e9-0fc4-4ba0-97c3-308ddda8078a",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "929fd4d0-b65e-43d6-afbf-37384e8a4f9b",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "817a3b61-7bf6-4054-8e74-eaf84035f7b5",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "33bb05cc-0f86-4910-9800-bfba3fac3ef3",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "a5b876d9-230b-4315-a25c-1e643a4d6ea9",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "f253b67f-74e7-41ba-a2c4-eb093774912d",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "794f431a-d5f8-4b85-940c-7d6e42c327a0",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "23d8ff24-943e-4078-a956-10f83b42c40e",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "b0e94cb2-da0c-403e-a937-6a9c370b4445",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "801157fe-e5ef-424c-90f8-32d6c813b4f0",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "a67ba2c4-698f-448f-9beb-c06157d0f7f0",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696180",
"to_ids": false,
"type": "cpe",
"uuid": "11e9cf62-5d17-422a-85c3-c9e267a07343",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696180",
"to_ids": false,
"type": "link",
"uuid": "c47f3e1b-5d45-4d1c-95e6-66fdca2cf3bd",
"value": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858"
}
]
},
{
"comment": "CVE-2021-26857: Enriched via the cve_advanced module",
"deleted": false,
"description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
"meta-category": "vulnerability",
"name": "vulnerability",
"template_uuid": "81650945-f186-437b-8945-9f31715d32da",
"template_version": "8",
"timestamp": "1732696195",
"uuid": "804f2152-e97e-48ce-9915-fa298949b955",
"ObjectReference": [
{
"comment": "",
"object_uuid": "804f2152-e97e-48ce-9915-fa298949b955",
"referenced_uuid": "df48cd61-c020-49f9-82a2-e0a798183068",
"relationship_type": "related-to",
"timestamp": "1732696196",
"uuid": "a2b52eb3-7484-45fd-90b4-ff413cbe5445"
},
{
"comment": "",
"object_uuid": "804f2152-e97e-48ce-9915-fa298949b955",
"referenced_uuid": "79ff18f5-0bc3-42c6-9351-030d98f8a125",
"relationship_type": "weakened-by",
"timestamp": "1732696196",
"uuid": "e4439fa0-1c2d-4b09-83c1-4f37aabd7d10"
},
{
"comment": "",
"object_uuid": "804f2152-e97e-48ce-9915-fa298949b955",
"referenced_uuid": "451d3abd-c6e7-45c3-90c0-e72a24d02f7a",
"relationship_type": "targeted-by",
"timestamp": "1732696196",
"uuid": "8d2dbbdc-076a-4024-b18a-7b134668bd8b"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696195",
"to_ids": false,
"type": "vulnerability",
"uuid": "be54eb8d-afb9-4221-ab99-724f7c5da484",
"value": "CVE-2021-26857"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696195",
"to_ids": false,
"type": "text",
"uuid": "6f8519c3-2c49-4fc1-990f-1489e3a1963f",
"value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "modified",
"timestamp": "1732696195",
"to_ids": false,
"type": "datetime",
"uuid": "97fba7b3-abc5-4e3e-9b98-b95a87383dd7",
"value": "2024-07-25T17:53:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-score",
"timestamp": "1732696195",
"to_ids": false,
"type": "float",
"uuid": "8320c18c-cbca-4a0b-9f74-19527335b8d1",
"value": "7.8"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-string",
"timestamp": "1732696195",
"to_ids": false,
"type": "text",
"uuid": "ab6a2994-75fa-4e3d-9d11-b3c49cbd2caf",
"value": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "published",
"timestamp": "1732696195",
"to_ids": false,
"type": "datetime",
"uuid": "9e3d4592-61cf-40a8-8393-138fa921e49a",
"value": "2021-03-03T00:15:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1732696195",
"to_ids": false,
"type": "text",
"uuid": "a2d2e0db-6114-42a5-bae1-d8d99a905e04",
"value": "Published"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "1fc3e47e-bce9-405b-bb81-7a794e79978d",
"value": "cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "5a87fdb8-3216-4638-b0fb-0f9316fe6600",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "d97249a0-44eb-46a7-b5d3-965971e3e0e7",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "ea661fc5-4731-425d-b260-0a49f846bc23",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "5d2a3b8a-d8d5-4e35-bf1b-8af851d51288",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "1be054c1-0d40-4397-819a-f40e3facdf63",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "26197089-5ee5-44b3-bc54-514ab362ff7c",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "b46a0b83-3d97-466c-b9b5-d534be8c78a2",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "3045df87-2445-4e5b-9b80-5cc3dc5b73ca",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "4f012103-f9a4-4b74-9d24-efebe6cc8c3d",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "bc6506f5-7557-4ab5-bf4d-be0f15ec6cba",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "33feb83a-d8e4-40f0-b71c-e780d97134cc",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "b78de65d-ae8d-4f46-941d-1bbdc9b7140c",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "3a263a87-3bb0-418a-af31-7655ea371ec8",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "b18c0d1b-00e9-4dda-bd6c-cc93d23ccae9",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "dfac8f85-86cd-484f-8ee0-06816a55f145",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "f302c7f7-a991-46c9-969c-318b4f10cb7f",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "13f902a2-93f4-40eb-a7a8-7f3177146098",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "54b9285d-406c-403f-a39d-7d0a310f5c19",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "eb590cd5-ba07-4c3f-a97a-25b83d85e91f",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "2dfbcaea-7060-4dd2-96e8-919019f0fbd9",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "0e9fc5b2-a174-4f32-9a33-d160fd7e656c",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "f7dc958f-f76e-43e1-94a5-b925e6deaa3e",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "16318509-8d34-4e9d-a9fb-1b938f2a862b",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696195",
"to_ids": false,
"type": "cpe",
"uuid": "54eb9d4e-64cd-41fc-a877-b4806b2eee35",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696195",
"to_ids": false,
"type": "link",
"uuid": "ca7214ba-126a-46ed-8b14-a5b53867a0d6",
"value": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857"
}
]
},
{
"comment": "CVE-2021-26857: Enriched via the cve_advanced module",
"deleted": false,
"description": "Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.",
"meta-category": "vulnerability",
"name": "weakness",
"template_uuid": "b8713fc0-d7a2-4b27-a182-38ed47966802",
"template_version": "1",
"timestamp": "1732696196",
"uuid": "79ff18f5-0bc3-42c6-9351-030d98f8a125",
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696196",
"to_ids": false,
"type": "weakness",
"uuid": "2c589972-dcb2-4891-9b70-5775e1dce1b6",
"value": "CWE-502"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696196",
"to_ids": false,
"type": "text",
"uuid": "169fdec2-56ef-4e09-b6d7-42bd0b7d8507",
"value": "Deserialization of Untrusted Data"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "status",
"timestamp": "1732696196",
"to_ids": false,
"type": "text",
"uuid": "ed6cfff9-ff65-47f5-a91c-49090b00c7c2",
"value": "Draft"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "weakness-abs",
"timestamp": "1732696196",
"to_ids": false,
"type": "text",
"uuid": "14865f6a-7434-4eb7-8c98-8002c9fc1866",
"value": "Base"
}
]
},
{
"comment": "CVE-2021-26857: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696196",
"uuid": "451d3abd-c6e7-45c3-90c0-e72a24d02f7a",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696196",
"to_ids": false,
"type": "text",
"uuid": "1bd79fd1-6081-47bf-a751-b82507cb2220",
"value": "586"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696196",
"to_ids": false,
"type": "text",
"uuid": "f99fa166-f179-43d4-9d58-660bc608c5c5",
"value": "Object Injection"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696196",
"to_ids": false,
"type": "text",
"uuid": "386a80ef-ed78-436c-b248-cd77236c3734",
"value": "An adversary attempts to exploit an application by injecting additional, malicious content during its processing of serialized objects. Developers leverage serialization in order to convert data or state into a static, binary format for saving to disk or transferring over a network. These objects are then deserialized when needed to recover the data/state. By injecting a malformed object into a vulnerable application, an adversary can potentially compromise the application by manipulating the deserialization process. This can result in a number of unwanted outcomes, including remote code execution."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696196",
"to_ids": false,
"type": "text",
"uuid": "24676e4a-7897-417c-8b8b-3e1a79c01be5",
"value": "The target application must unserialize data before validation."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696196",
"to_ids": false,
"type": "text",
"uuid": "62bf580d-9055-43b1-b9c5-7e7c12539175",
"value": "Implementation: Validate object before deserialization process Design: Limit which types can be deserialized. Implementation: Avoid having unnecessary types or gadgets available that can be leveraged for malicious ends. Use an allowlist of acceptable classes. Implementation: Keep session state on the server, when possible."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696196",
"to_ids": false,
"type": "weakness",
"uuid": "ff5acb37-1f53-42b5-85df-38b369af1b77",
"value": "CWE-502"
}
]
},
{
"comment": "CVE-2021-26855: Enriched via the cve_advanced module",
"deleted": false,
"description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
"meta-category": "vulnerability",
"name": "vulnerability",
"template_uuid": "81650945-f186-437b-8945-9f31715d32da",
"template_version": "8",
"timestamp": "1732696216",
"uuid": "cb455add-8385-4a5c-912d-267c7d54b69e",
"ObjectReference": [
{
"comment": "",
"object_uuid": "cb455add-8385-4a5c-912d-267c7d54b69e",
"referenced_uuid": "669b4001-f63d-4bdf-b9e2-4fb86abba5df",
"relationship_type": "related-to",
"timestamp": "1732696217",
"uuid": "295c43ad-8f64-4bd3-aa8d-f31318beff1d"
},
{
"comment": "",
"object_uuid": "cb455add-8385-4a5c-912d-267c7d54b69e",
"referenced_uuid": "e901580b-1b8a-4af1-8b30-560ab54e6360",
"relationship_type": "weakened-by",
"timestamp": "1732696217",
"uuid": "ff849b6d-42e1-47c3-a817-20db5ec42eee"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696216",
"to_ids": false,
"type": "vulnerability",
"uuid": "0951b835-6e11-4e28-9204-f1b39f3fc132",
"value": "CVE-2021-26855"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696216",
"to_ids": false,
"type": "text",
"uuid": "fa1c0baf-372c-478e-8b96-6a6abc2bae00",
"value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "modified",
"timestamp": "1732696216",
"to_ids": false,
"type": "datetime",
"uuid": "e159553c-dddb-450b-a307-c4d1bd3dac5a",
"value": "2024-02-15T20:18:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-score",
"timestamp": "1732696216",
"to_ids": false,
"type": "float",
"uuid": "b0bd19e0-9e03-48df-9d8d-56e3e7e2252f",
"value": "9.1"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-string",
"timestamp": "1732696216",
"to_ids": false,
"type": "text",
"uuid": "1a2bc7a0-20e3-43c3-8fde-bdf2b9b48399",
"value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "published",
"timestamp": "1732696216",
"to_ids": false,
"type": "datetime",
"uuid": "6340325e-9ea0-4acb-ac22-0a8380681ba2",
"value": "2021-03-03T00:15:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1732696216",
"to_ids": false,
"type": "text",
"uuid": "756631b4-66cf-4b51-a680-c5cc1f67ed0f",
"value": "Published"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696216",
"to_ids": false,
"type": "cpe",
"uuid": "bfb7d1cc-23a0-46eb-b477-f48ba82291db",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696216",
"to_ids": false,
"type": "cpe",
"uuid": "1c6f7bfc-30b9-45fe-b330-8691ac663a7b",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696216",
"to_ids": false,
"type": "cpe",
"uuid": "b8432f88-36e9-4008-bd4a-6628e245bc3d",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696216",
"to_ids": false,
"type": "cpe",
"uuid": "fe286db3-e3ec-496d-b61e-16385eee4a4f",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696216",
"to_ids": false,
"type": "cpe",
"uuid": "d094dd84-e75e-4e30-9f82-d6029b647346",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696216",
"to_ids": false,
"type": "cpe",
"uuid": "e398aec5-b770-425e-b96b-0d443bd6b364",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696216",
"to_ids": false,
"type": "cpe",
"uuid": "32ab20fa-20ba-46ae-a008-6f884fbbadaf",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "66de6340-8c98-4591-9811-2089d86b8f87",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "bb4f1258-09eb-4197-a4d7-78f6fb1350cf",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "b099c487-565c-437e-a2d2-6b2129d9b29f",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "2f38479d-81bb-40bb-b67e-fd81b1432aff",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "f4a3fae0-ac37-4c1d-8e96-c6d562ae2cdd",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "90dc366f-8460-405b-bf34-8335333fb357",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "5a046d30-f0c0-418c-b14f-000a79338909",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "33652cda-4870-43fc-8470-ca6f1f0d09f6",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "e97c9fd0-420d-4cba-aaf9-568473ae3bea",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "50467b68-d558-483b-9e0b-353cd56d7ab1",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "ab8aca4a-6b3a-43f5-99f9-56efa5373290",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "831467c9-2374-49b9-b2aa-5751b85b2cdd",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "8423c498-7856-40ff-83a2-d11932bfc185",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "db46325f-1740-44c4-809c-da9b5519ba36",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "3393d891-ca69-42f2-829a-a31e7c049761",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "320c4eb9-6a2f-4eae-a9c6-d1b7140ece1b",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696217",
"to_ids": false,
"type": "cpe",
"uuid": "4360b0c0-898f-4bd6-bc1d-f8c14c21e058",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696217",
"to_ids": false,
"type": "link",
"uuid": "fcf5008e-3328-4e1d-8ebf-73adcd5b199e",
"value": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696217",
"to_ids": false,
"type": "link",
"uuid": "324be550-5fc3-4c34-925a-064a3f19f79e",
"value": "http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696217",
"to_ids": false,
"type": "link",
"uuid": "6f3ed291-7224-475d-b99f-028ef1c6aa65",
"value": "http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696217",
"to_ids": false,
"type": "link",
"uuid": "b2d57a06-013c-4aaa-a801-516df29a4e34",
"value": "http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696217",
"to_ids": false,
"type": "link",
"uuid": "631380f1-ff64-4a57-a737-82a3f1a84d53",
"value": "http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html"
}
]
},
{
"comment": "CVE-2021-26855: Enriched via the cve_advanced module",
"deleted": false,
"description": "Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.",
"meta-category": "vulnerability",
"name": "weakness",
"template_uuid": "b8713fc0-d7a2-4b27-a182-38ed47966802",
"template_version": "1",
"timestamp": "1732696217",
"uuid": "e901580b-1b8a-4af1-8b30-560ab54e6360",
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696217",
"to_ids": false,
"type": "weakness",
"uuid": "8224f5ea-cab0-4abe-a78d-be13233acb58",
"value": "CWE-918"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696217",
"to_ids": false,
"type": "text",
"uuid": "b5bc1a43-a2c7-4346-a087-52aea6512d60",
"value": "Server-Side Request Forgery (SSRF)"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "status",
"timestamp": "1732696217",
"to_ids": false,
"type": "text",
"uuid": "669b06f6-366f-4294-9179-ae6284d5db61",
"value": "Incomplete"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "weakness-abs",
"timestamp": "1732696217",
"to_ids": false,
"type": "text",
"uuid": "b82794b1-2410-4288-8560-854aaeff8271",
"value": "Base"
}
]
},
{
"comment": "CVE-2021-26857: Enriched via the cve_advanced module",
"deleted": false,
"description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
"meta-category": "vulnerability",
"name": "vulnerability",
"template_uuid": "81650945-f186-437b-8945-9f31715d32da",
"template_version": "8",
"timestamp": "1732696237",
"uuid": "aef48aac-76e3-426a-a5ec-9ff59fb018a1",
"ObjectReference": [
{
"comment": "",
"object_uuid": "aef48aac-76e3-426a-a5ec-9ff59fb018a1",
"referenced_uuid": "df48cd61-c020-49f9-82a2-e0a798183068",
"relationship_type": "related-to",
"timestamp": "1732696238",
"uuid": "85ad8c5f-74b6-4d86-b1f6-ef1ce75f57f6"
},
{
"comment": "",
"object_uuid": "aef48aac-76e3-426a-a5ec-9ff59fb018a1",
"referenced_uuid": "79ff18f5-0bc3-42c6-9351-030d98f8a125",
"relationship_type": "weakened-by",
"timestamp": "1732696238",
"uuid": "8b278d11-ea69-4d60-a363-dfbe34457916"
},
{
"comment": "",
"object_uuid": "aef48aac-76e3-426a-a5ec-9ff59fb018a1",
"referenced_uuid": "451d3abd-c6e7-45c3-90c0-e72a24d02f7a",
"relationship_type": "targeted-by",
"timestamp": "1732696238",
"uuid": "66c472c8-f8e8-446f-9db1-a47ef0b2a582"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696237",
"to_ids": false,
"type": "vulnerability",
"uuid": "24b0d983-12bd-43ad-91be-c8a8c89477a1",
"value": "CVE-2021-26857"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696237",
"to_ids": false,
"type": "text",
"uuid": "be350cc6-e827-49b4-98ad-dd2cd6f3d588",
"value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "modified",
"timestamp": "1732696237",
"to_ids": false,
"type": "datetime",
"uuid": "27950270-4281-4c03-9e8e-db7e56b26884",
"value": "2024-07-25T17:53:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-score",
"timestamp": "1732696237",
"to_ids": false,
"type": "float",
"uuid": "7f7b12ed-8294-471a-8a4a-e1698a91468c",
"value": "7.8"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-string",
"timestamp": "1732696237",
"to_ids": false,
"type": "text",
"uuid": "60eaa5f4-503d-46c4-820e-6e93a1f3e4a9",
"value": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "published",
"timestamp": "1732696237",
"to_ids": false,
"type": "datetime",
"uuid": "63a5be28-80e0-4c46-9f7c-065d558d49ad",
"value": "2021-03-03T00:15:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1732696237",
"to_ids": false,
"type": "text",
"uuid": "e9b8c86c-071f-412f-a811-36f824287c4a",
"value": "Published"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "bbe78660-23df-426c-b3a5-4de56ff93a8a",
"value": "cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "922b6bae-341c-4a83-aef5-1cc5a7909fc7",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "35106698-d8ec-451b-b141-afda008a0025",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "e2282a2f-11a4-461f-bece-34794ec5346a",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "8aebd7f8-18c5-4686-a9fe-d1f35a8330b4",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "430fa96f-a5b0-4ebf-aaa6-cb1213666095",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "b1e5e396-b4c1-4602-a680-cdcb44d0e9e1",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "4c37f8fb-7add-4362-99a4-b52c49428ef0",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "2c5e6ddc-db13-4a30-b943-a94227b4b380",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "3633fb1b-b269-47ff-b7d6-bedb784cd8bd",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "89976646-f99e-4b68-8cca-69cd145263ce",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "00584f76-d4aa-4624-a0c8-eca8810dcaf8",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "aa4a51a4-74c7-42ef-923d-a9df45698e8a",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696237",
"to_ids": false,
"type": "cpe",
"uuid": "abe7f39f-514e-4bf9-9c41-ecbc29568a42",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "e07e35d6-5970-456d-8e17-aedce35234b1",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "a698ab2e-76cf-4901-ae36-e62e6a57990a",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "c6ff9226-5593-448f-9b26-35bc942e4961",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "afdd0f22-409d-4c27-a6fc-88b42a619c8c",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "3f28da97-6f4d-4e8a-890c-559a538fc961",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "ed2e215d-5239-4609-987b-e389be0601bc",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "e3574953-a098-470d-a0a1-5618734b1e5d",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "f915ddfd-f111-4478-9703-f01f0e1c4261",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "19acd381-30e8-4d8b-bafa-35bba986019b",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "9ba5d647-9750-4a1e-b1f3-aca52523cc50",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696238",
"to_ids": false,
"type": "cpe",
"uuid": "e28666da-c54c-4fd9-b6ed-ca09940c5a6e",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696238",
"to_ids": false,
"type": "link",
"uuid": "4b3ce651-c27a-457a-8370-9ce95a261a69",
"value": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857"
}
]
},
{
"comment": "CVE-2021-26858: Enriched via the cve_advanced module",
"deleted": false,
"description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
"meta-category": "vulnerability",
"name": "vulnerability",
"template_uuid": "81650945-f186-437b-8945-9f31715d32da",
"template_version": "8",
"timestamp": "1732696258",
"uuid": "2311608a-fa79-4786-97d9-b9c71d1b7414",
"ObjectReference": [
{
"comment": "",
"object_uuid": "2311608a-fa79-4786-97d9-b9c71d1b7414",
"referenced_uuid": "67d93fff-c91c-41d1-89b2-dced25d651a5",
"relationship_type": "related-to",
"timestamp": "1732696259",
"uuid": "ea1a67a7-127c-4cd4-aeaa-d9205b697574"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696258",
"to_ids": false,
"type": "vulnerability",
"uuid": "d8ed3697-50ac-4b78-9ed1-ce8c74e02276",
"value": "CVE-2021-26858"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696258",
"to_ids": false,
"type": "text",
"uuid": "b932e0b6-770d-4e06-982d-c58c39099eb3",
"value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "modified",
"timestamp": "1732696258",
"to_ids": false,
"type": "datetime",
"uuid": "44632092-ccb0-4620-bc49-9a8af3f43511",
"value": "2024-07-25T17:53:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-score",
"timestamp": "1732696258",
"to_ids": false,
"type": "float",
"uuid": "e6ce3155-e4a0-464c-8258-97d58fe992e4",
"value": "7.8"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-string",
"timestamp": "1732696258",
"to_ids": false,
"type": "text",
"uuid": "9c78b720-c47d-4890-91d7-ce672e165fea",
"value": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "published",
"timestamp": "1732696258",
"to_ids": false,
"type": "datetime",
"uuid": "b91cbfbf-fa25-491b-90e8-918dc7e21091",
"value": "2021-03-03T00:15:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1732696258",
"to_ids": false,
"type": "text",
"uuid": "e106148c-b4db-4555-85ae-0e749461faa0",
"value": "Published"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "bbe73b3e-ec35-4f5a-bb13-797841604a03",
"value": "cpe:2.3:a:microsoft:exchange_server:2010:sp3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "810ebb89-86c5-48d0-8b4c-ef7aaf7f0469",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "d8d2d3f4-0c0b-40f8-9227-9f8f838422c9",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "21fc020d-b60d-4b12-90bc-b7055f8e44c8",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "499bfed7-f4db-4090-a56c-f5ea28e5785a",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "a1e02561-43df-44da-b3f8-2e8edaccec86",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "56193f96-7358-4e91-a34c-7bd16bf9979f",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "44177eb9-9713-48bc-ab44-b5739031d207",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "3fb52fae-aaac-4f65-a8b8-a8985f1ad06c",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "de25d66a-51a6-459e-b988-c1a7b973180f",
"value": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "ec1406a8-7da0-456c-9f01-e1727a082121",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "247ba062-b790-4de7-8024-fdfb41dc7098",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "ecc6cd2a-716f-4ce7-905f-625d5a914b5b",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "187967c9-29da-4662-8181-f252e5137033",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "8fa86201-5ecc-49f5-a70b-3ea9a1f3bde8",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "efd1f23f-a4bf-47bc-81b6-204f30cbd553",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "6fe937b3-d7d7-49ce-872c-62de10a40e1b",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "b13bdb8d-ae54-45a2-881c-b1498be8f5a4",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "4b8c4242-f0cd-4842-83e0-07ea3b1a8d2d",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "8db0869c-e99d-48eb-86af-bdf53502f278",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696258",
"to_ids": false,
"type": "cpe",
"uuid": "de3b4163-d2ec-4936-8708-86c600caef3b",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696259",
"to_ids": false,
"type": "cpe",
"uuid": "45e6578d-3894-4c10-a8ab-9a00eeba4199",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696259",
"to_ids": false,
"type": "cpe",
"uuid": "0aaec67b-4dbb-41d7-b5d6-49fc277ff291",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696259",
"to_ids": false,
"type": "cpe",
"uuid": "0f14f4b9-2a7f-49c5-aef1-5c921361e74f",
"value": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696259",
"to_ids": false,
"type": "cpe",
"uuid": "a46345b2-bc86-45f7-b059-4b7bd376db4e",
"value": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696259",
"to_ids": false,
"type": "link",
"uuid": "2cbbc360-eb57-46cb-bae4-28bf75c56c3a",
"value": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858"
}
]
},
{
"comment": "CVE-2024-21887: Enriched via the cve_advanced module",
"deleted": false,
"description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.",
"meta-category": "vulnerability",
"name": "vulnerability",
"template_uuid": "81650945-f186-437b-8945-9f31715d32da",
"template_version": "8",
"timestamp": "1732696319",
"uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"ObjectReference": [
{
"comment": "",
"object_uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"referenced_uuid": "dd05a57a-ed94-4a99-b95f-b6d8a835fa31",
"relationship_type": "related-to",
"timestamp": "1732696322",
"uuid": "3b7f0f14-6bb7-4400-8bd8-750a1e2a6dbb"
},
{
"comment": "",
"object_uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"referenced_uuid": "59eda582-0c44-4695-94be-2fc8be45a740",
"relationship_type": "weakened-by",
"timestamp": "1732696322",
"uuid": "2a6992c2-5bdc-49e1-af44-c206aa2a5462"
},
{
"comment": "",
"object_uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"referenced_uuid": "df3f8d43-4697-44cb-acf0-0bf24c1f73ed",
"relationship_type": "targeted-by",
"timestamp": "1732696322",
"uuid": "dc7f3374-d2d9-49b3-a48f-2dc4cb84fbdf"
},
{
"comment": "",
"object_uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"referenced_uuid": "0b8e087d-e807-4737-a91d-a7b23b7dcab2",
"relationship_type": "targeted-by",
"timestamp": "1732696322",
"uuid": "29f5cbbc-df08-4363-a91b-22668b86a076"
},
{
"comment": "",
"object_uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"referenced_uuid": "6d7a3232-2d66-438e-808d-3186176eb00b",
"relationship_type": "targeted-by",
"timestamp": "1732696322",
"uuid": "15eed6bb-5f2d-4425-8c86-3ebf86dedf14"
},
{
"comment": "",
"object_uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"referenced_uuid": "a0168d78-1fca-4506-9874-52644df4ef2d",
"relationship_type": "targeted-by",
"timestamp": "1732696322",
"uuid": "4973ce0a-93ce-4d63-bbf5-5e5edd59e7c3"
},
{
"comment": "",
"object_uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"referenced_uuid": "c7044849-01f8-4713-90fe-9ee40ae51ae4",
"relationship_type": "targeted-by",
"timestamp": "1732696322",
"uuid": "f7c78ad4-c385-4f06-a5e3-5da917982fce"
},
{
"comment": "",
"object_uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"referenced_uuid": "105b6cc6-7686-4912-88bd-3154dbf554bc",
"relationship_type": "targeted-by",
"timestamp": "1732696322",
"uuid": "2af22040-427d-4b60-b26e-6f87846c14a6"
},
{
"comment": "",
"object_uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"referenced_uuid": "b6d47efc-6f91-42a2-be2b-e37b2ece71a7",
"relationship_type": "targeted-by",
"timestamp": "1732696322",
"uuid": "94e8fe3f-3402-452b-a517-8d893338187c"
},
{
"comment": "",
"object_uuid": "6dd8b81f-5394-462d-b6d4-75eb10e0604e",
"referenced_uuid": "9578f5a0-9e1c-4e32-a99a-0fa0a48b5f5a",
"relationship_type": "targeted-by",
"timestamp": "1732696322",
"uuid": "2d7fa1f4-c7bb-470b-abf4-5f8d9bbfb21f"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696319",
"to_ids": false,
"type": "vulnerability",
"uuid": "1316d9d0-7e17-40f9-85d4-92556fa25ef5",
"value": "CVE-2024-21887"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696319",
"to_ids": false,
"type": "text",
"uuid": "2f26072a-cf9a-4961-bfc3-173286605bb6",
"value": "A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "modified",
"timestamp": "1732696319",
"to_ids": false,
"type": "datetime",
"uuid": "403f46c4-9096-4db0-a080-a8db675ac699",
"value": "2024-06-10T16:21:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-score",
"timestamp": "1732696319",
"to_ids": false,
"type": "float",
"uuid": "9cdf7066-4b8c-4fdc-9548-0b82a6feab03",
"value": "9.1"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "cvss-string",
"timestamp": "1732696319",
"to_ids": false,
"type": "text",
"uuid": "f492f1e1-4c07-4a57-88f9-12e1282c2985",
"value": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "published",
"timestamp": "1732696319",
"to_ids": false,
"type": "datetime",
"uuid": "f86fc471-f225-4045-b84a-2d7ae1f99e8a",
"value": "2024-01-12T17:15:00+00:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1732696319",
"to_ids": false,
"type": "text",
"uuid": "c3fbb59b-7e5d-4841-92c2-cc51e13c0632",
"value": "Published"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "45cbe632-37ec-4fda-8a03-8b2b30d2973a",
"value": "cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "1c81af9f-7ea0-4f46-982f-d77be503f8d2",
"value": "cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "26510048-98e7-4746-9e54-7010ab926e42",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "c6241137-ec3c-4c8d-9a2d-562cb527aebc",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "6d22fed0-d5e8-46cf-82aa-df8da8ff6551",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "88d1c15a-f7ce-4845-9cf3-93b445122cb9",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "f94db586-064b-454a-80c5-223ce81d1d8f",
"value": "cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "bbce6f96-5281-4e7d-bb79-20034d492de3",
"value": "cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "c7f55076-a29c-4fbe-bba7-8387c0c70483",
"value": "cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "0e2c461c-8ced-41b8-a677-6ab8b6769ed5",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "13d18564-b72a-4305-98e7-2a49b0c8496b",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "eb4156c3-9155-49de-943a-5fb6636eba1b",
"value": "cpe:2.3:a:ivanti:connect_secure:22.5:r2.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "ebc6147d-7607-4622-9e30-9a284bbf9e93",
"value": "cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "b0d4d53d-3edb-4cf2-9f90-f5560481146c",
"value": "cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "0e4f7fd9-d327-4587-a86c-3875b87de4c6",
"value": "cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "ea3572dc-cb52-4d83-af7f-05c7ed9da3b9",
"value": "cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "43ab379b-e347-4471-9457-64a0e8812ee8",
"value": "cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "1cf98e7b-923e-4184-a3c3-d9197857ba6d",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "4ceefd6c-3dbd-459c-98d8-b0c172ccdf80",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "e8ca8429-d658-4ce1-9066-8d3e8f62c357",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "bb6be1de-89ec-4d4b-a7d6-e109fb28d039",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "f9360588-e317-47a4-9c3e-0655027008c6",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "5b528d68-c693-4034-8fee-c48f43f4bdde",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "fdf49641-84ad-40d8-8ed4-f8472fcd437f",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "f80ff78a-cbf4-4014-9ca9-8a1f285eaa51",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "62f93c0b-b8b4-4805-8efa-e30f3c493b8f",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "5d0c685d-128b-4a19-a2e7-7cd2e277d6d9",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "b41bb034-ef22-4872-af21-b41ac20b8f3a",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "f003a845-67e4-4228-aa26-ffd413d12cfd",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "99513dfb-9920-487e-8070-ee2b932c1541",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "0b4e1d7c-2c7e-4507-aa8b-c8c7c5cdce4d",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "3fa5033f-1603-4004-aedb-88452c671dd6",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696319",
"to_ids": false,
"type": "cpe",
"uuid": "a5c7bb48-72f0-43f8-bcf1-7082efb9e15d",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "74a85a68-a3e0-4141-9680-a9ce5b23bb48",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "fc789803-fafe-49a1-95de-093bcfc57e5a",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "9258e298-0e49-401d-9daf-b247aa910e89",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "31e9090c-d584-4083-ac9a-0c52b68f8de1",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "b0e97d2e-7a8f-4e0a-a755-0505ecfbf9ec",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "9c4d4bdc-20ed-4570-964c-4b3128219b36",
"value": "cpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "2d7f42c6-65b6-4008-b790-f5a7e66c62c7",
"value": "cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "dd83534d-10bc-48e9-adf7-c13da3445666",
"value": "cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "a633fc72-eb8c-4e0e-8f89-a0fb16be5d7a",
"value": "cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "90133901-6ed1-4960-8895-f33926409142",
"value": "cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "2806971b-bf48-4515-b253-9d8a894798a2",
"value": "cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "bcde82fa-bc3a-46c8-b714-1a48b541fdab",
"value": "cpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "b4a598bd-5ef8-41d0-9c10-dd0a844562dd",
"value": "cpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "b6583884-00b5-4285-8b15-58f1a48d8457",
"value": "cpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "4f5196e2-7793-4c18-aed9-ecc5b7c494e8",
"value": "cpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "0ff26620-16d2-4cad-9a93-62eff4937c4b",
"value": "cpe:2.3:a:ivanti:policy_secure:22.5:r2.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "0e4f5cd3-22b5-47c1-9615-429821cd2479",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "6f77dda5-f734-413a-9312-8e834b466176",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "f45090e8-2e2f-4c5e-8296-9c2ca8b53397",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "7444c9e1-9cf5-4c6b-9f7a-5c42b6d601b8",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "4f4569b2-873e-41af-b1e7-047155df623a",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "fbf08a5b-1023-43bc-8089-13372f512d17",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "0600d816-daec-4113-9e63-44c2e8cbf5e9",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "80d87229-39b4-47c9-9f9d-bb186e157fd9",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "015287a7-dfaf-4e0b-83b1-185c477cd813",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "9b5aa341-7d57-40a8-bb1c-192c38b94481",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "dc88398a-88e8-490e-a13e-85f9d9e3ead2",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "6a10b7df-fde1-4ca7-9838-52f1625476a9",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "0fc2050f-bc31-492b-9510-46459cc2d848",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "e3aa9c18-b93c-4c20-9e82-7712e609294f",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "597b605e-480a-4665-add8-531401e54ca3",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "9d5c1be3-d488-48f8-a075-640976bbe5eb",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "31e61cf7-bfe2-42f9-8c1c-56deb070bd15",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "017d5f15-2dad-48d0-b101-b818365eb56f",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "78409a1b-e8b2-4311-8d5d-83819621e022",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "f17ecc65-9de1-482c-8e7e-e46fc36cfd1e",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "93a57a28-0eeb-4288-8434-580c22a34e7d",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "bb685c70-e593-4eea-b52e-ad967038894f",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "cd46797f-1218-483c-a2f2-d2297059f101",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "7d0707b1-2bf6-444c-8636-9d227bd8bf13",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "046cb7ee-f3bf-46ce-97b1-3d2eef73be33",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "9eace043-e932-4e1c-8a75-3d2167dbacdf",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "11eb706d-d842-4158-87ca-b376347894c2",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "5b7e660a-3e42-4d64-864c-b196f2918599",
"value": "cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "02038d38-1242-4e65-8f0f-db6a3d034448",
"value": "cpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "236bf15c-f539-46a6-9bb3-b1ed3b8d8e6e",
"value": "cpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "217f81bf-1dcf-4615-afad-5436b054d2b7",
"value": "cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vulnerable-configuration",
"timestamp": "1732696320",
"to_ids": false,
"type": "cpe",
"uuid": "12e20bfe-d292-48b7-98e7-6f6edd1f44ea",
"value": "cpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:*"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696320",
"to_ids": false,
"type": "link",
"uuid": "a48a98c1-024b-45e2-8744-66c386f51a67",
"value": "https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "references",
"timestamp": "1732696320",
"to_ids": false,
"type": "link",
"uuid": "1183db87-a748-442e-8954-e71515fa8d21",
"value": "http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html"
}
]
},
{
"comment": "CVE-2024-21887: Enriched via the cve_advanced module",
"deleted": false,
"description": "Weakness object describing a common weakness enumeration which can describe usable, incomplete, draft or deprecated weakness for software, equipment of hardware.",
"meta-category": "vulnerability",
"name": "weakness",
"template_uuid": "b8713fc0-d7a2-4b27-a182-38ed47966802",
"template_version": "1",
"timestamp": "1732696320",
"uuid": "59eda582-0c44-4695-94be-2fc8be45a740",
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "id",
"timestamp": "1732696320",
"to_ids": false,
"type": "weakness",
"uuid": "c8b478ee-c66f-4241-8451-6e126acc9726",
"value": "CWE-77"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696320",
"to_ids": false,
"type": "text",
"uuid": "178c36ae-a32c-48c9-9006-b56d885e161f",
"value": "Improper Neutralization of Special Elements used in a Command ('Command Injection')"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "status",
"timestamp": "1732696320",
"to_ids": false,
"type": "text",
"uuid": "7ccf1d85-a0e9-49bb-8400-2b50d96aca1a",
"value": "Draft"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "weakness-abs",
"timestamp": "1732696320",
"to_ids": false,
"type": "text",
"uuid": "65202907-136e-4206-9346-29649f9d0d85",
"value": "Class"
}
]
},
{
"comment": "CVE-2024-21887: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696320",
"uuid": "0b8e087d-e807-4737-a91d-a7b23b7dcab2",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696320",
"to_ids": false,
"type": "text",
"uuid": "5f0f4b03-1da6-4d3f-9b12-cfb791a44a52",
"value": "248"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696320",
"to_ids": false,
"type": "text",
"uuid": "7ef735d3-b648-466f-8646-55f105b9204a",
"value": "Command Injection"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "a49cdfe1-b4fd-47ef-b2ad-1fc0133f85b8",
"value": "An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "c33cfe8a-e884-4e63-b866-88ad1f4ca540",
"value": "The target application must accept input from the user and then use this input in the construction of commands to be executed. In virtually all cases, this is some form of string input that is concatenated to a constant string defined by the application to form the full command to be executed."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "0f1991b4-a3ba-4e64-a7be-2bea7e38e0bd",
"value": "All user-controllable input should be validated and filtered for potentially unwanted characters. Using an allowlist for input is desired, but if use of a denylist approach is necessary, then focusing on command related terms and delimiters is necessary. Input should be encoded prior to use in commands to make sure command related characters are not treated as part of the command. For example, quotation characters may need to be encoded so that the application does not treat the quotation as a delimiter. Input should be parameterized, or restricted to data sections of a command, thus removing the chance that the input will be treated as part of the command itself."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "149b3e35-b41d-4e12-9445-579805ba6621",
"value": "CWE-77"
}
]
},
{
"comment": "CVE-2024-21887: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696321",
"uuid": "6d7a3232-2d66-438e-808d-3186176eb00b",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "47d07189-5dc2-4a4e-ae9a-6e5778c3d169",
"value": "40"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "caae8ac6-a47b-40b3-b0dc-1e972e91f293",
"value": "Manipulating Writeable Terminal Devices"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "f2066fa5-85c0-44a1-8dcc-9670c43f9e6b",
"value": "This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "dbfab4d0-c743-4d3a-adf6-25194ff65d1d",
"value": "User terminals must have a permissive access control such as world writeable that allows normal users to control data on other user's terminals."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "d09e668c-e09b-4a5e-bad5-8d87995faa51",
"value": "Design: Ensure that terminals are only writeable by named owner user and/or administrator Design: Enforce principle of least privilege"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "f4def2ad-8545-4de5-bc6c-76d2c8646467",
"value": "CWE-77"
}
]
},
{
"comment": "CVE-2024-21887: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696321",
"uuid": "a0168d78-1fca-4506-9874-52644df4ef2d",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "a28bfd99-ea53-4977-8ace-82d47384ab8e",
"value": "43"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "d4f4cb9a-b2bd-4c32-9c48-d4627d3c9097",
"value": "Exploiting Multiple Input Interpretation Layers"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "5004e667-c2ab-48ec-860b-bebf8642658f",
"value": "An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a \"layer\" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: <parser1> --> <input validator> --> <parser2>. In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "7dcd4e37-707a-431f-bd91-d8aab4d281a0",
"value": "User input is used to construct a command to be executed on the target system or as part of the file name. Multiple parser passes are performed on the data supplied by the user."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "e8757e3b-84da-4065-937d-dd113c2f4cf2",
"value": "An iterative approach to input validation may be required to ensure that no dangerous characters are present. It may be necessary to implement redundant checking across different input validation layers. Ensure that invalid data is rejected as soon as possible and do not continue to work with it. Make sure to perform input validation on canonicalized data (i.e. data that is data in its most standard form). This will help avoid tricky encodings getting past the filters. Assume all input is malicious. Create an allowlist that defines all valid input to the software system based on the requirements specifications. Input that does not match against the allowlist would not be permitted to enter into the system."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "371d8cad-3dc3-4677-a094-88ddacbd5bec",
"value": "CWE-171"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "278b2407-b3b5-4f82-adff-c49cd51fc262",
"value": "CWE-179"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "5d7ebc70-f9fc-448a-b276-5a6349ffd7ae",
"value": "CWE-181"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "7d4328b5-ad4f-48f0-9d17-9771b56f4c07",
"value": "CWE-183"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "b67ace1b-ac73-45ca-9d6e-e6fb2d28df38",
"value": "CWE-184"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "ba4cc34c-7312-4abb-8bd0-66c4116b31ed",
"value": "CWE-20"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "4264ce56-d403-4186-a9bb-6710884b0105",
"value": "CWE-697"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "b785a3c6-c469-41e3-a734-9620e0f44186",
"value": "CWE-707"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "3a528870-d5a9-4872-8456-5c79cbbd5892",
"value": "CWE-74"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "59a8cc5d-0f09-4507-8426-0c14f8df3626",
"value": "CWE-77"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "cfc252b9-7558-403e-aba0-b2cb06199437",
"value": "CWE-78"
}
]
},
{
"comment": "CVE-2024-21887: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696321",
"uuid": "c7044849-01f8-4713-90fe-9ee40ae51ae4",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "a3884313-6df6-4164-a50f-614707ab034b",
"value": "136"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "34143a4b-129c-4b72-8150-0de55e0d5daa",
"value": "LDAP Injection"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "b2198de7-50ce-497d-a916-8c66095fef7e",
"value": "An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "a78876ae-cfe1-4d60-a5fe-235f2189101c",
"value": "The target application must accept a string as user input, fail to sanitize characters that have a special meaning in LDAP queries in the user input, and insert the user-supplied string in an LDAP query which is then processed."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "d555b4ae-4e16-4006-908f-9aa0c6702c18",
"value": "Strong input validation - All user-controllable input must be validated and filtered for illegal characters as well as LDAP content. Use of custom error pages - Attackers can glean information about the nature of queries from descriptive error messages. Input validation must be coupled with customized error pages that inform about an error without disclosing information about the LDAP or application."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "b9665458-7732-4860-b368-459713b240b1",
"value": "CWE-20"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "a2d996d0-1c02-4101-8bc2-2571fe40af86",
"value": "CWE-77"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "9f2fbbd6-5f45-47ae-973c-e73fcd20dca5",
"value": "CWE-90"
}
]
},
{
"comment": "CVE-2024-21887: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696321",
"uuid": "105b6cc6-7686-4912-88bd-3154dbf554bc",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "b8132e37-0bba-4d1f-ba5f-9a78d7ce9132",
"value": "15"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "c890933a-deb2-43e4-992a-55e5d5d2c241",
"value": "Command Delimiters"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "ba0d400b-949c-4670-bd7c-d5928ea965c2",
"value": "An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "daf3f595-c46c-442d-815b-3bc10272fa46",
"value": "Software's input validation or filtering must not detect and block presence of additional malicious command."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696321",
"to_ids": false,
"type": "text",
"uuid": "67d34206-4f7c-4095-9aaa-13fd04340940",
"value": "Design: Perform allowlist validation against a positive specification for command length, type, and parameters. Design: Limit program privileges, so if commands circumvent program input validation or filter routines then commands do not running under a privileged account Implementation: Perform input validation for all remote content. Implementation: Use type conversions such as JDBC prepared statements."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696321",
"to_ids": false,
"type": "weakness",
"uuid": "96a0fc91-6639-4837-83d4-37db921d4ea1",
"value": "CWE-138"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "8efe3f6f-ee00-4d40-9c65-7f270dbd98e5",
"value": "CWE-140"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "9a00c48b-f829-4d82-a27c-84e097a34eb7",
"value": "CWE-146"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "0f85d8b7-5c24-4ad8-ab06-06d48677b463",
"value": "CWE-154"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "85a7ed2a-bb18-4471-83a1-17ff0f28fb50",
"value": "CWE-157"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "f4cf6530-bb45-4f47-8acb-c8058f61bfc9",
"value": "CWE-184"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "d3a0bcac-2f70-40cf-a1d9-27814bb04d6a",
"value": "CWE-185"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "a7bc1fe2-6f92-407b-854f-64d3eb0e67a1",
"value": "CWE-697"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "6a3d1b1b-5dbe-4ad1-a591-b8e57e3ff61d",
"value": "CWE-713"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "9adb20c1-7c66-4a5d-9389-0516f349952f",
"value": "CWE-77"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "b83ab496-083d-46b1-8141-b0f1289c3c8f",
"value": "CWE-78"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "97b973ff-564a-4b75-a7bd-1d1f270922da",
"value": "CWE-93"
}
]
},
{
"comment": "CVE-2024-21887: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696322",
"uuid": "b6d47efc-6f91-42a2-be2b-e37b2ece71a7",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696322",
"to_ids": false,
"type": "text",
"uuid": "a5a43a7d-7ed3-43c1-b08d-c7ef04b7968e",
"value": "183"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696322",
"to_ids": false,
"type": "text",
"uuid": "90772fdd-4937-487f-8ef2-94fc07722ff7",
"value": "IMAP/SMTP Command Injection"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696322",
"to_ids": false,
"type": "text",
"uuid": "6754751d-ab97-4d2f-a5b8-ca7db18953bb",
"value": "An attacker exploits weaknesses in input validation on IMAP/SMTP servers to execute commands on the server. Web-mail servers often sit between the Internet and the IMAP or SMTP mail server. User requests are received by the web-mail servers which then query the back-end mail server for the requested information and return this response to the user. In an IMAP/SMTP command injection attack, mail-server commands are embedded in parts of the request sent to the web-mail server. If the web-mail server fails to adequately sanitize these requests, these commands are then sent to the back-end mail server when it is queried by the web-mail server, where the commands are then executed. This attack can be especially dangerous since administrators may assume that the back-end server is protected against direct Internet access and therefore may not secure it adequately against the execution of malicious commands."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696322",
"to_ids": false,
"type": "text",
"uuid": "6cb9874b-ed87-4f63-b1bc-2a78f5e87c2e",
"value": "The target environment must consist of a web-mail server that the attacker can query and a back-end mail server. The back-end mail server need not be directly accessible to the attacker. The web-mail server must fail to adequately sanitize fields received from users and passed on to the back-end mail server. The back-end mail server must not be adequately secured against receiving malicious commands from the web-mail server."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "e8beb9e1-093c-4332-b767-53fcc2eff4d0",
"value": "CWE-77"
}
]
},
{
"comment": "CVE-2024-21887: Enriched via the cve_advanced module",
"deleted": false,
"description": "Attack pattern describing a common attack pattern enumeration and classification.",
"meta-category": "vulnerability",
"name": "attack-pattern",
"template_uuid": "35928348-56be-4d7f-9752-a80927936351",
"template_version": "1",
"timestamp": "1732696322",
"uuid": "9578f5a0-9e1c-4e32-a99a-0fa0a48b5f5a",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "id",
"timestamp": "1732696322",
"to_ids": false,
"type": "text",
"uuid": "3de13648-9776-4b82-957c-60b4080e7fe4",
"value": "75"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "name",
"timestamp": "1732696322",
"to_ids": false,
"type": "text",
"uuid": "f40958cc-8724-421a-87bc-c4c816160adf",
"value": "Manipulating Writeable Configuration Files"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1732696322",
"to_ids": false,
"type": "text",
"uuid": "e9586764-8266-4001-8d69-28f699b8c233",
"value": "Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "prerequisites",
"timestamp": "1732696322",
"to_ids": false,
"type": "text",
"uuid": "56a8f6b0-d100-457d-bf44-a69b994a4e36",
"value": "Configuration files must be modifiable by the attacker"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "solutions",
"timestamp": "1732696322",
"to_ids": false,
"type": "text",
"uuid": "4ae79391-88fb-4796-be0e-70cd6a484c3c",
"value": "Design: Enforce principle of least privilege Design: Backup copies of all configuration files Implementation: Integrity monitoring for configuration files Implementation: Enforce audit logging on code and configuration promotion procedures. Implementation: Load configuration from separate process and memory space, for example a separate physical device like a CD"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "850e7b64-96f2-4f70-ab6f-50db9c1bfaf4",
"value": "CWE-346"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "7f198a45-9eff-4e0c-8d81-364abe1d4211",
"value": "CWE-349"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "fafe7f39-066f-4126-b135-bcab9229c5ed",
"value": "CWE-353"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "9f7e7a08-e9f1-4c3e-97ba-2d4a0367d588",
"value": "CWE-354"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "7d0051ed-b826-41a0-8eff-fa29c962bd47",
"value": "CWE-713"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "39a8fd8a-fe34-4849-9f2f-055659f57f3a",
"value": "CWE-77"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "related-weakness",
"timestamp": "1732696322",
"to_ids": false,
"type": "weakness",
"uuid": "a13f228e-9385-4c3d-ae1c-e5b7f6a69d0e",
"value": "CWE-99"
}
]
},
{
"comment": "",
"deleted": false,
"description": "An object describing a YARA rule (or a YARA rule name) along with its version.",
"meta-category": "misc",
"name": "yara",
"template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
"template_version": "6",
"timestamp": "1732696549",
"uuid": "20d3b0fe-91f1-44e7-b4a1-b16d5206d58c",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "context",
"timestamp": "1732696549",
"to_ids": false,
"type": "text",
"uuid": "20cda5b8-9602-41c3-a9d7-6a0d554eb0d1",
"value": "all"
},
{
"category": "Payload installation",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "yara",
"timestamp": "1732696549",
"to_ids": true,
"type": "yara",
"uuid": "24f56a69-6897-46dd-8d1e-29a0492c5f8a",
"value": "rule Backdoor_GHOSTSPIDER_beacon_loader\r\n{\r\n meta:\r\n author = \"Trend Micro Research\"\r\n\r\n strings:\r\n $clr = {\r\n\t\t\tC7 45 ?? 43 4C 52 43\r\n\t\t\tC7 45 ?? 72 65 61 74\r\n\t\t\tC7 45 ?? 65 49 6E 73\r\n\t\t\tC7 45 ?? 74 61 6E 63\r\n\t\t}\r\n\r\n $chunk1 = {\r\n\t\t\tC1 EA ??\r\n\t\t\t0F B6 D2\r\n\t\t\t8B 34 95 ?? ?? ?? ??\r\n\t\t\t8B 55 ??\r\n\t\t\tC1 EA ??\r\n\t\t\t8B 14 95 ?? ?? ?? ??\r\n\t\t\tC1 E9 ??\r\n\t\t\t0F B6 F9\r\n\t\t\t33 34 BD ?? ?? ?? ??\r\n\t\t\t8B 7D ??\r\n\t\t\t89 75 ??\r\n\t\t\t31 55 ??\r\n\t\t\t0F B6 55 ??\r\n\t\t\t8B 75 ??\r\n\t\t\t33 34 95 ?? ?? ?? ??\r\n\t\t\t8B D3\r\n\t\t\t33 B0 ?? ?? ?? ??\r\n\t\t}\r\n\r\n $chunk2 = {\r\n 41 0F B6 1B\r\n 41 8B C2\r\n 99\r\n 41 F7 F9\r\n 48 63 C2\r\n 0F B6 4C 05 ??\r\n 44 03 C1\r\n 44 03 C3\r\n }\r\n\r\n condition:\r\n uint16(0) == 0x5a4d and\r\n\t\tfilesize < 300KB and\r\n (\r\n $clr and any of ($chunk*)\r\n )\r\n}"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "yara-rule-name",
"timestamp": "1732696549",
"to_ids": false,
"type": "text",
"uuid": "9aaa324e-f25d-4f12-9f99-6aacc158615d",
"value": "Backdoor_GHOSTSPIDER_beacon_loader"
}
]
},
{
"comment": "",
"deleted": false,
"description": "An object describing a YARA rule (or a YARA rule name) along with its version.",
"meta-category": "misc",
"name": "yara",
"template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
"template_version": "6",
"timestamp": "1732696579",
"uuid": "6c8fab68-2138-4c27-9597-9ff6e1a4ffb2",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "context",
"timestamp": "1732696579",
"to_ids": false,
"type": "text",
"uuid": "8bd7a81a-023d-4b65-9a97-baad09338596",
"value": "all"
},
{
"category": "Payload installation",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "yara",
"timestamp": "1732696579",
"to_ids": true,
"type": "yara",
"uuid": "01291b43-0a48-4984-b61c-5533f2e49123",
"value": "rule Backdoor_GHOSTSPIDER_stager\r\n{\r\n meta:\r\n author = \"Trend Micro Research\"\r\n\r\n strings:\r\n $s1 = \"new_comp\" ascii wide\r\n $s2 = \"del_comp\" ascii wide\r\n $s3 = \"new_client\" ascii wide\r\n $s4 = \"del_client\" ascii wide\r\n $s5 = \"new_base\" ascii wide\r\n $s6 = \"del_base\" ascii wide\r\n $cookie = \"phpsessid=%s; b=%d; path=/; expires=%s\" ascii wide\r\n\r\n condition:\r\n uint16(0) == 0x5a4d and\r\n filesize < 300KB and\r\n (\r\n $cookie and 2 of ($s*)\r\n )\r\n}"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "yara-rule-name",
"timestamp": "1732696579",
"to_ids": false,
"type": "text",
"uuid": "7ed196ca-bd5a-44ff-a93d-5dda79e43b45",
"value": "Backdoor_GHOSTSPIDER_stager"
}
]
},
{
"comment": "SNAPPYBEE payload",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1732697095",
"uuid": "54ae012f-305c-4d09-84af-beacb401288d",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1732697095",
"to_ids": true,
"type": "sha256",
"uuid": "3310283b-f647-4728-a618-12a7e7659411",
"value": "1a38303fb392ccc5a88d236b4f97ed404a89c1617f34b96ed826e7bb7257e296"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1732697095",
"to_ids": true,
"type": "filename",
"uuid": "af2a4e22-9039-4408-be74-cd6166c459cc",
"value": "dbindex.dat"
}
]
},
{
"comment": "SNAPPYBEE loader",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1732697149",
"uuid": "abf6c3b8-fe85-436f-90c6-538b9d419ca0",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1732697149",
"to_ids": true,
"type": "sha256",
"uuid": "0e6d7d57-76e4-4353-a9b2-06ea3a3c1b14",
"value": "05840de7fa648c41c60844c4e5d53dbb3bc2a5250dcb158a95b77bc0f68fa870"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1732697149",
"to_ids": true,
"type": "filename",
"uuid": "4177b2f4-da72-4e6d-804f-79078dacaadf",
"value": "imfsbDLL.dll"
}
]
},
{
"comment": "SNAPPYBEE loader",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1732697179",
"uuid": "4b7cd1b0-c0e4-45c5-bc6b-7d38b54d7f25",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1732697179",
"to_ids": true,
"type": "sha256",
"uuid": "972cd54b-5a5a-459c-9a92-2ba91958dc54",
"value": "b2b617e62353a672626c13cc7ad81b27f23f91282aad7a3a0db471d84852a9ac"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1732697179",
"to_ids": true,
"type": "filename",
"uuid": "5a2dc7e7-14aa-4b51-ba14-f4979a0a046e",
"value": "DgApi.dll"
}
]
},
{
"comment": "SNAPPYBEE loader",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1732697210",
"uuid": "25be932d-b3e2-42df-b5e6-657d82bf1916",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1732697210",
"to_ids": true,
"type": "sha256",
"uuid": "c3469afe-c214-489d-b8ae-991f6141567b",
"value": "6d64643c044fe534dbb2c1158409138fcded757e550c6f79eada15e69a7865bc"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1732697210",
"to_ids": true,
"type": "filename",
"uuid": "e6f45250-88eb-45de-9a1d-91c124728584",
"value": "imfsbDLL.dll"
}
]
},
{
"comment": "SNAPPYBEE loader",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1732697233",
"uuid": "bfa7d29f-7f74-4dd9-82ab-1606cf366cfe",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1732697233",
"to_ids": true,
"type": "sha256",
"uuid": "6768cb00-0ace-4b10-a27a-3f98b7922bfb",
"value": "25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1732697233",
"to_ids": true,
"type": "filename",
"uuid": "330aaa76-3fab-4c71-a0f9-86cff870068b",
"value": "DgApi.dll"
}
]
},
{
"comment": "DEMODEX loader",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1732697254",
"uuid": "e8b5e843-a4e3-434d-9f34-a6ea7a85f9b0",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1732697254",
"to_ids": true,
"type": "sha256",
"uuid": "0aaeaf8c-0aa3-4bc0-88e0-80692839f333",
"value": "9ba31dc1e701ce8039a9a272ef3d55aa6df66984a322e0d309614a5655e7a85c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1732697254",
"to_ids": true,
"type": "filename",
"uuid": "ec0a2d27-c374-4d1b-9a3c-3ad7f0510e03",
"value": "%WINDIR%\\System32\\SstpCfs.dll"
}
]
},
{
"comment": "DEMODEX driver",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1732697280",
"uuid": "c43cc341-1655-466f-9baa-00a409f5d8f6",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1732697280",
"to_ids": true,
"type": "sha256",
"uuid": "5933e2d9-97ed-425c-8d4c-dbd1161845ae",
"value": "16c8afd3b35c76a476851f4994be180f0cd72c7b250e493d3eb8c58619587266"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1732697280",
"to_ids": true,
"type": "filename",
"uuid": "90b1e7fa-5957-453e-bf95-237a95e7e88c",
"value": "%WINDIR%\\System32\\drivers\\dumpfiskfss.sys"
}
]
},
{
"comment": "DEMODEX PowerShell dropper ",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1732697337",
"uuid": "8e8cdf20-8235-4dc7-a015-7654010b9e88",
"Attribute": [
{
"category": "Payload delivery",
"comment": "DEMODEX PowerShell dropper",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1732697337",
"to_ids": true,
"type": "sha256",
"uuid": "809caae6-d89c-46b7-a0cd-771e7e3b77d8",
"value": "2fd4a49338d79f4caee4a60024bcd5ecb5008f1d5219263655ef49c54d9acdec"
},
{
"category": "Payload delivery",
"comment": "DEMODEX PowerShell dropper",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1732697337",
"to_ids": true,
"type": "filename",
"uuid": "dc46a854-975d-479c-a85f-fd6692ec0560",
"value": "onedrived.ps1"
}
]
},
{
"comment": "SNAPPYBEE payload",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1732697362",
"uuid": "da6199b2-b6a7-4cf7-8f81-9a897db8cd09",
"Attribute": [
{
"category": "Payload delivery",
"comment": "SNAPPYBEE payload",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1732697362",
"to_ids": true,
"type": "sha256",
"uuid": "5a997915-ca6a-48be-97e4-cced7661c3ec",
"value": "fba149eb5ef063bc6a2b15bd67132ea798919ed36c5acda46ee9b1118b823098"
},
{
"category": "Payload delivery",
"comment": "SNAPPYBEE payload",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1732697362",
"to_ids": true,
"type": "filename",
"uuid": "920633c3-28c2-481c-b79c-4ef17c86f29d",
"value": "NortonLog.txt"
}
]
},
{
"comment": "SNAPPYBEE loader\t",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1732697403",
"uuid": "fc910d5a-983c-45ab-8475-380426288138",
"Attribute": [
{
"category": "Payload delivery",
"comment": "SNAPPYBEE loader",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1732697403",
"to_ids": true,
"type": "sha256",
"uuid": "5e7aa56f-0bfc-4d17-8c82-9088684f8642",
"value": "fc3be6917fd37a083646ed4b97ebd2d45734a1e154e69c9c33ab00b0589a09e5"
},
{
"category": "Payload delivery",
"comment": "SNAPPYBEE loader",
"deleted": false,
"disable_correlation": false,
"object_relation": "filename",
"timestamp": "1732697403",
"to_ids": true,
"type": "filename",
"uuid": "01938a95-4711-45e6-9310-3e7b22533d3a",
"value": "WINMM.dll"
}
]
},
{
"comment": "The frpc C&C 165.154.227[.]192 could be linked to an SSL certificate (SHA256: 2b5e7b17fc6e684ff026df3241af4a651fc2b55ca62f8f1f7e34ac8303db9a31) previously used by ShadowPad, which is another shared tool among several Chinese APT groups. In addition, the C&C IP address was also mentioned in a Fortinet report and indicators of compromise related to the Ivanti exploit.",
"deleted": false,
"description": "x509 object describing a X.509 certificate",
"meta-category": "network",
"name": "x509",
"template_uuid": "d1ab756a-26b5-4349-9f43-765630f0911c",
"template_version": "13",
"timestamp": "1732697852",
"uuid": "0e88a065-9d44-479e-93af-82f834e1dbce",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "x509-fingerprint-sha256",
"timestamp": "1732697852",
"to_ids": true,
"type": "x509-fingerprint-sha256",
"uuid": "909a7296-467a-4727-9488-c816a276a643",
"value": "2b5e7b17fc6e684ff026df3241af4a651fc2b55ca62f8f1f7e34ac8303db9a31"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1732697852",
"to_ids": true,
"type": "ip-dst",
"uuid": "f2955f24-b4ef-4f72-acd3-4def89aef969",
"value": "165.154.227.192"
}
]
}
],
"EventReport": [
{
"name": "Report from - https://www.trendmicro.com/en_us/research/24/k/earth-estries.html (1732695682)",
"content": "# Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions\r\n\r\n\r\nSince 2023, APT group Earth Estries has aggressively targeted key industries globally with sophisticated techniques and new backdoors, like GHOSTSPIDER and MASOL RAT, for prolonged espionage operations. \r\n\r\nBy: Leon M Chang, Theo Chen, Lenart Bermejo, Ted Lee\r\n \r\n November 25, 2024\r\n\r\n#### Summary\r\n \r\n* Earth Estries, a Chinese APT group, has primarily targeted critical sectors like telecommunications and government entities across the US, Asia\\-Pacific, Middle East, and South Africa since 2023\\.\r\n* The group employs advanced attack techniques and multiple backdoors, such as GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, affecting several Southeast Asian telecommunications companies and government entities.\r\n* Earth Estries exploits public\\-facing server vulnerabilities to establish initial access and uses living\\-off\\-the\\-land binaries for lateral movement within networks to deploy malware and conduct long\\-term espionage.\r\n* The group has compromised over 20 organizations, targeting various sectors including telecommunications, technology, consulting, chemical, and transportation industries, as well as government agencies and NGOs in numerous countries.\r\n* Earth Estries uses a complex C\\&C infrastructure managed by different teams, and their operations often overlap with TTPs of other known Chinese APT groups, indicating possible use of shared tools from malware\\-as\\-a\\-service providers.\r\n\r\n\r\nSince 2023, Earth Estries (aka Salt Typhoon, FamousSparrow, GhostEmperor and UNC2286\\) has emerged as one of the most aggressive Chinese advanced persistent threat (APT) groups, primarily targeting critical industries such as telecommunications and government entities in the US, the Asia\\-Pacific region, the Middle East, and South Africa. In this blog entry, we will highlight their evolving attack techniques and analyze the motivation behind their operations, providing insights into their long\\-term targeted attacks.\r\n\r\n\r\nA key finding from our recent investigation is the discovery of a new backdoor, GHOSTSPIDER, identified during attacks on Southeast Asian telecommunications companies. We will explore the technical details of GHOSTSPIDER, its impact across multiple countries, and interesting findings when we were tracking its command\\-and\\-control (C\\&C) infrastructure. We have also uncovered the group\u2019s use of the modular backdoor SNAPPYBEE (aka Deed RAT), another tool shared among Chinese APT groups.\u00a0\r\n\r\n\r\nFurthermore, we discovered that Earth Estries uses another cross\\-platform backdoor, which we initially identified during our investigation of Southeast Asian government incidents in 2020\\. We named it MASOL RAT based on its PDB string. We couldn\u2019t link MASOL RAT to any known threat group at the time due to limited information. However, this year we observed that Earth Estries has been deploying MASOL RAT on Linux devices targeting Southeast Asian government networks. More details about MASOL RAT will be provided in this blog entry.\r\n\r\n\r\nRecently, we also noticed that Microsoft has tracked the APT groups FamousSparrow and GhostEmperor under the name Salt Typhoon. However, we don\u2019t have sufficient evidence that Earth Estries is related to the recent news of a recent Salt Typhoon cyberattack, as we have not seen a more detailed report on Salt Typhoon. Currently, we can only confirm that some of Earth Estries\u2019 tactics, techniques, and procedures (TTPs) overlap with that of FamousSparrow and GhostEmperor.\u00a0\r\n\r\n\r\n#### Motivation\r\n\r\n\r\nWe have observed that Earth Esties has been conducting prolonged attacks targeting governments and internet service providers since 2020\\. In mid\\-2022, we noticed that the attackers also started targeting service providers for governments and telecommunications companies. For example, we found that in 2023, the attackers had also targeted consulting firms and NGOs that work with the U.S. federal go
"id": "827",
"event_id": "268984",
"timestamp": "1732695790",
"uuid": "fe91a5fe-b3b1-41ab-8948-bafb2fab4bd0",
"deleted": false
}
]
}
}