Vulnerability Details CVE-2021-28246
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 17.8%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 4.4
References
Products affected by CVE-2021-28246
-
cpe:2.3:a:broadcom:ehealth:6.3
-
cpe:2.3:a:broadcom:ehealth:6.3.1
-
cpe:2.3:a:broadcom:ehealth:6.3.2
-
cpe:2.3:a:broadcom:ehealth:6.3.2.01
-
cpe:2.3:a:broadcom:ehealth:6.3.2.02
-
cpe:2.3:a:broadcom:ehealth:6.3.2.03
-
cpe:2.3:a:broadcom:ehealth:6.3.2.04
-
cpe:2.3:a:broadcom:ehealth:6.3.2.05
-
cpe:2.3:a:broadcom:ehealth:6.3.2.06
-
cpe:2.3:a:broadcom:ehealth:6.3.2.07
-
cpe:2.3:a:broadcom:ehealth:6.3.2.08
-
cpe:2.3:a:broadcom:ehealth:6.3.2.09
-
cpe:2.3:a:broadcom:ehealth:6.3.2.10
-
cpe:2.3:a:broadcom:ehealth:6.3.2.11
-
cpe:2.3:a:broadcom:ehealth:6.3.2.12