Back to Database
Status published
Medium
CVE-2021-23154
Command injection in Lens causes arbitrary shell command execution when malicious custom helm chart configuration provided
Vulnerability Description
In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to run on the system.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-23154
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Eren Karahasan (locomoco.dev@gmail.com)
More from Mirantis
View All →CVE-2022-0484
Improper URL Validation causes Mirantis Container Cloud Lens Extension to open external programs
High
8.8
CVE-2022-0270
Improper header sanitization in bored-agent causes escalation of privilege
High
8.8
CVE-2021-44458
Lack of websocket authentication in Lens causes remote code execution when visiting a malicious website
High
8.3
CVE-2021-23218
Memory Leak in Mirantis Container Runtime (MCR) running in FIPS mode causes a Denial of Service
Medium
5.3
Affected Vendor
Mirantis
View all reports →Affected Software
Lens
Vulnerable Versions:
5.3
Timeline
Official Publish:
January 10th, 2022
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H