Sign-up

ID

VAR-202101-1833


CVE

CVE-2021-3152


TITLE

Home Assistant directory traversal vulnerability

Trust: 0.6

sources: CNVD: CNVD-2021-07543

DESCRIPTION

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Home Assistant does have a security update that is worthwhile in addressing this situation. Home Assistant is an open source home automation management system. The system is mainly used to control home automation equipment. There is a directory traversal vulnerability before Home Assistant 2021.1.3 version. The vulnerability stems from failure to properly filter special elements in resource or file paths. Attackers can use this vulnerability to obtain directory information

Trust: 1.53

sources: NVD: CVE-2021-3152 // CNVD: CNVD-2021-07543 // VULMON: CVE-2021-3152

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-07543

AFFECTED PRODUCTS

vendor:home assistantmodel:home-assistantscope:ltversion:2021.1.3

Trust: 1.0

vendor:homemodel:assistant home assistantscope:ltversion:2021.1.3

Trust: 0.6

sources: CNVD: CNVD-2021-07543 // NVD: CVE-2021-3152

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-3152
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2021-07543
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202101-2388
value: MEDIUM

Trust: 0.6

VULMON: CVE-2021-3152
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-3152
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2021-07543
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-3152
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2021-07543 // VULMON: CVE-2021-3152 // CNNVD: CNNVD-202101-2388 // NVD: CVE-2021-3152

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.0

sources: NVD: CVE-2021-3152

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202101-2388

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202101-2388

PATCH

title:Patch for Home Assistant directory traversal vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/246076

Trust: 0.6

title:Arch Linux Advisories: [ASA-202101-44] home-assistant: information disclosureurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-202101-44

Trust: 0.1

title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2021-3152 log

Trust: 0.1

sources: CNVD: CNVD-2021-07543 // VULMON: CVE-2021-3152

EXTERNAL IDS

db:NVDid:CVE-2021-3152

Trust: 2.3

db:CNVDid:CNVD-2021-07543

Trust: 0.6

db:CNNVDid:CNNVD-202101-2388

Trust: 0.6

db:VULMONid:CVE-2021-3152

Trust: 0.1

sources: CNVD: CNVD-2021-07543 // VULMON: CVE-2021-3152 // CNNVD: CNNVD-202101-2388 // NVD: CVE-2021-3152

REFERENCES

url:https://www.home-assistant.io/blog/2021/01/14/security-bulletin/

Trust: 1.7

url:https://www.home-assistant.io/blog/2021/01/22/security-disclosure/

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-3152

Trust: 1.2

url:https://cwe.mitre.org/data/definitions/22.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://security.archlinux.org/asa-202101-44

Trust: 0.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/195409

Trust: 0.1

sources: CNVD: CNVD-2021-07543 // VULMON: CVE-2021-3152 // CNNVD: CNNVD-202101-2388 // NVD: CVE-2021-3152

SOURCES

db:CNVDid:CNVD-2021-07543
db:VULMONid:CVE-2021-3152
db:CNNVDid:CNNVD-202101-2388
db:NVDid:CVE-2021-3152

LAST UPDATE DATE

2024-11-23T22:47:42.854000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-07543date:2021-02-03T00:00:00
db:VULMONid:CVE-2021-3152date:2021-02-02T00:00:00
db:CNNVDid:CNNVD-202101-2388date:2021-02-09T00:00:00
db:NVDid:CVE-2021-3152date:2024-11-21T06:21:00.420

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-07543date:2021-01-31T00:00:00
db:VULMONid:CVE-2021-3152date:2021-01-26T00:00:00
db:CNNVDid:CNNVD-202101-2388date:2021-01-26T00:00:00
db:NVDid:CVE-2021-3152date:2021-01-26T18:16:27.770