Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2021-34745
CVE-2021-34745:
vulnerability analysis and mitigation
Overview
A vulnerability (CVE-2021-34745) was discovered in the AppDynamics .NET Agent for Windows that could allow an attacker with local access to escalate privileges to SYSTEM level. The vulnerability was disclosed on August 18, 2021, affecting all AppDynamics .NET Agent for Windows releases prior to version 21.7 that were installed with Microsoft Installer (MSI) (AppDynamics Docs).
Technical details
The vulnerability stems from the .NET Agent Coordinator Service executing code with SYSTEM privileges. The issue allows an authenticated local user to create a custom process that would be launched with SYSTEM privileges. The vulnerability has been assigned a CVSS score of 7.8, indicating a high severity level (AppDynamics Docs).
Impact
A successful exploitation of this vulnerability could allow an attacker with local access to execute arbitrary commands on the underlying operating system with SYSTEM privileges. This level of access would give the attacker complete control over the affected system (AppDynamics Docs).
Mitigation and workarounds
AppDynamics has released a software update (version 21.7) that addresses this vulnerability. No workarounds are available, and users are advised to upgrade to the fixed version available from the AppDynamics Download Portal. The .NET Agent for Linux and the .NET Microservices Agent are not affected by this vulnerability (AppDynamics Docs).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management