PatchTheCVEstor2rrd vulnerabilities and fixes
Recent CVEs affecting stor2rrd, with upgrade or downgrade steps. 5 tracked.
stor2rrd has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 3. Most recent: 2021-11-08. Highest priority: CVE-2020-24032 (score 62/100).
- CVE-2021-42372 HIGH 8.8 UPGRADE UPGRADE A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows au
- CVE-2021-42371 CRITICAL 9.8 UPGRADE UPGRADE lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.
- CVE-2021-42370 HIGH 7.5 UPGRADE UPGRADE A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext informa
- CVE-2020-24032 CRITICAL 9.8 DOWNGRADE DOWNGRADE tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell
- CVE-2019-19041 HIGH 7.2 DOWNGRADE DOWNGRADE An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41
FAQ
How do I fix stor2rrd vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is stor2rrd being exploited right now?
None of the tracked stor2rrd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which stor2rrd CVE should I patch first?
CVE-2020-24032 currently ranks highest (62/100): tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell .