Deserialization Vulnerability in Inikulin Replicator Prototype
CVE-2021-33420

9.8CRITICAL

Key Information:

Vendor: Replicator Project
Status: Replicator
Vendor: CVE Published:; 15 December 2022

🔔 Create Replicator Project Vulnerability Alert

What is CVE-2021-33420?

A deserialization vulnerability in the Inikulin Replicator tool prior to version 1.0.4 allows attackers to exploit the fromSerializable function in a TypedArray object. This issue can potentially enable remote attackers to execute arbitrary code in the context of the application, posing significant security risks. Users are advised to update to the latest version to mitigate this vulnerability and maintain the integrity of their systems.

References

https://github.com/inikulin/replicator/issues/16

https://github.com/inikulin/replicator/pull/17

https://github.com/inikulin/replicator/commit/2c626242fb4...

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 15, 2022
Vulnerability Reserved
May 20, 2021

CVE-2021-33420 Data

JSON