CVE-2021-32756

    Dashboard / Vulnerabilities / CVE-2021-32756

    CVE-2021-32756

    Published: 21 Jul 2021Last Modified: 7 Aug 2026

    Summary:

    Details: ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack.

    References: https://github.com/ManageIQ/manageiq/security/advisories/GHSA-32x4-vj4r-57rq

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 1fee77ff1a1010d3e680995a518d2e61cd3327dd
    Fixed -None

    Affected versions

    jansa-1-NA

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32756 | CVE-DB