CVE-2021-4281

low-risk
Published 2022-12-26

A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It is recommended to apply a patch to fix this issue. VDB-216842 is the identifier assigned to this vulnerability.

Do I need to act?

~
2.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.6/10 Medium
ADJACENT_NETWORK / HIGH complexity

Affected Products (1)

For The Badge

Affected Vendors

Forthebadge

References (8)

Patch https://github.com/BraveUX/for-the-badge/commit/55b5a234c0fab935df5fb08365bc8fe9...
Third Party Advisory https://github.com/BraveUX/for-the-badge/pull/165
Permissions Required https://vuldb.com/?ctiid.216842
Permissions Required https://vuldb.com/?id.216842
Patch https://github.com/BraveUX/for-the-badge/commit/55b5a234c0fab935df5fb08365bc8fe9...
Third Party Advisory https://github.com/BraveUX/for-the-badge/pull/165
Permissions Required https://vuldb.com/?ctiid.216842
Permissions Required https://vuldb.com/?id.216842
22
/ 100
low-risk
Severity 12/34 · Low
Exploitability 5/34 · Minimal
Exposure 5/34 · Minimal