CVE-2021-24040 Vulnerability Details

  /     /     /  

CVE-2021-24040 Metadata Quick Info

CVE Published: 10/09/2021 | CVE Updated: 03/08/2024 | CVE Year: 2021
Source: facebook | Vendor: Facebook | Product: ParlAI
Status : PUBLISHED

---

CVE-2021-24040 Description

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-502
CWE Name: Deserialization of Untrusted Data (CWE-502)
Source: Facebook

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).