CVE-2021-28246 is a privilege escalation vulnerability affecting CA eHealth Performance Manager versions up to 6.3.2.12. A low-privileged user can create a malicious shared library in a writable RPATH, which is then executed with the privileges of the ehealth user when the emtgtctl2 executable runs. This vulnerability carries a high CVSS score of 7.8 due to its local attack vector, low complexity, and high impact on confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and community discussion is minimal, it's important to note that this vulnerability affects an unsupported product.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.3.2.12CPE matchmatch criteria | cpe:2.3:a:broadcom:ehealth:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.