{"id":"CVE-2021-32849","published":"2022-01-26T21:30:14Z","modified":"2025-04-22T18:27:54Z","title":"Arbitrary command execution in Gerapy","vendor":"Gerapy","product":"gerapy","tier":"core","eol":null,"affectedVersions":[{"vendor":"Gerapy","product":"gerapy","versions":[">= 0.9.9, < 0.9.9"]}],"description":{"text":"Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0765,"percentile":0.94561,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-03-04","exploitedFirstSeen":"2024-03-04","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-04&host_type=src&vulnerability=cve-2021-32849","date":"2024-03-04"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2021-076-gerapy/","tags":["x_refsource_MISC"]},{"url":"https://github.com/Gerapy/Gerapy/security/advisories/GHSA-756h-r2c9-qp5j","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Gerapy/Gerapy/issues/197","tags":["x_refsource_MISC"]},{"url":"https://github.com/Gerapy/Gerapy/issues/217","tags":["x_refsource_MISC"]},{"url":"https://lgtm.com/projects/g/Gerapy/Gerapy?mode=tree&ruleFocus=1505994646253","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"gerapy","vulnerableRanges":["<0.9.9"],"patched":["0.9.9"],"from":["GHSA-756h-r2c9-qp5j","PYSEC-2022-17"],"provenance":"source"}],"advisories":[{"id":"GHSA-756h-r2c9-qp5j","url":"https://github.com/advisories/GHSA-756h-r2c9-qp5j","severity":"HIGH","ecosystem":"PyPI","package":"gerapy","vulnerableRanges":["<0.9.9"],"patched":["0.9.9"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-0112","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0112","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2022-04-25","earliestUrl":"https://github.com/lowkey0808/cve-2021-32849","repos":[{"name":"lowkey0808/cve-2021-32849","url":"https://github.com/lowkey0808/cve-2021-32849","stars":2,"created":"2022-04-25"}]},"first":{"date":"2022-04-25","source":"PoC-in-GitHub","url":"https://github.com/lowkey0808/cve-2021-32849"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-01-26","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-32849","provenance":"source"},{"date":"2022-04-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/lowkey0808/cve-2021-32849","provenance":"source"},{"date":"2024-03-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-04&host_type=src&vulnerability=cve-2021-32849","provenance":"source"}],"speed":{"daysToPublicExploit":89,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 969 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.91,"detail":"percentile 0.9456"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-gerapy-cve-2020-7698","packageHistory":[{"cve":"CVE-2020-7698","published":"2020-07-29","fixed":"0.9.3","kev":false},{"cve":"CVE-2021-43857","published":"2021-12-27","fixed":"0.9.8","kev":false,"link":{"from":"CVE-2021-43857","to":"CVE-2021-32849","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:gerapy","fromFixed":"0.9.8","toFixed":"0.9.9","daysApart":30},{"kind":"similar","provenance":"machine","score":0.85,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2021-32849","published":"2022-01-26","fixed":"0.9.9","kev":false}],"package":"PyPI:gerapy"}}