Common Weakness Enumeration

CWE-691

Discouraged

Insufficient Control Flow Management

Abstraction: Pillar · Status: Draft

API response cwe.mitre.org

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

31 vulnerabilities reference this CWE, most recent first.

CVE-2021-4106 (GCVE-0-2021-4106)

Vulnerability from cvelistv5 – Published: 2022-02-16 16:38 – Updated: 2024-09-16 17:18
VLAI
Title
Vulnerability in Snow Inventory Java Scanner
Summary
A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventory Java Scanner 1.0
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
Snow CNA
References
Impacted products
Date Public
2022-02-16 00:00
Credits
John Thiell, Martin Spielmann and Stefan Lubienetzki
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:16:04.155Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.snowsoftware.com/s/feed/0D5690000BObYdUCQV"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Snow Inventory Java Scanner",
          "vendor": "SNOW",
          "versions": [
            {
              "status": "affected",
              "version": "1.0 0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "John Thiell, Martin Spielmann and Stefan Lubienetzki"
        }
      ],
      "datePublic": "2022-02-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventory Java Scanner 1.0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-691",
              "description": "CWE-691",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-16T16:38:02.000Z",
        "orgId": "ea911274-ddd9-4e68-b39a-d7d6ae8b8a65",
        "shortName": "Snow"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.snowsoftware.com/s/feed/0D5690000BObYdUCQV"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Please upgrade to Snow Inventory Java Scanner 2.0"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Vulnerability in Snow Inventory Java Scanner",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@snowsoftware.com",
          "DATE_PUBLIC": "2022-02-16T10:00:00.000Z",
          "ID": "CVE-2021-4106",
          "STATE": "PUBLIC",
          "TITLE": "Vulnerability in Snow Inventory Java Scanner"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Snow Inventory Java Scanner",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "1.0",
                            "version_value": "0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SNOW"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "John Thiell, Martin Spielmann and Stefan Lubienetzki"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventory Java Scanner 1.0"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-691"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://community.snowsoftware.com/s/feed/0D5690000BObYdUCQV",
              "refsource": "MISC",
              "url": "https://community.snowsoftware.com/s/feed/0D5690000BObYdUCQV"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Please upgrade to Snow Inventory Java Scanner 2.0"
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ea911274-ddd9-4e68-b39a-d7d6ae8b8a65",
    "assignerShortName": "Snow",
    "cveId": "CVE-2021-4106",
    "datePublished": "2022-02-16T16:38:02.235Z",
    "dateReserved": "2021-12-13T00:00:00.000Z",
    "dateUpdated": "2024-09-16T17:18:32.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

No mitigation information available for this CWE.

CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions

This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.

← Back to the CWE list