LiveActive security incident?Get immediate response
CVE Record

CVE-2021-42718: Sensitive data unnecessarily returned from authenticated API

Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables through the Admin Console API on port 8800. This CVE was originally reserved in 2021 and later publicly disclosed by Replicated on their website on 21 October 2021. However, it mistakenly remained in the Reserved But Public (RBP) status with the CVE Numbering Authority (CNA). Please note that this product reached its end of life on 31 December 2024. Publishing this CVE with the CNA was required to comply with CNA rules, despite the fact that the issue was disclosed and fixed four years ago, and the affected product is no longer supported as of 2024. Summary of VulnerabilityThis advisory discloses a low severity security vulnerability in the versions of Replicated Classic listed above (“Affected Replicated Classic Versions”) DescriptionReplicated Classic versions prior to 2.53.1 have an authenticated API from the Replicated Admin Console that may expose sensitive data including application secrets, depending on how the application manifests are written. A user with valid credentials and access to the Admin Console port (8800) on the Replicated Classic server can retrieve container definitions including environment variables which may contain passwords and other secrets depending on how the application is configured. This data is shared over authenticated sessions to the Admin Console only, and was never displayed or used in the application processing. To remediate this issue, we removed the sensitive data from the API, sending only the data to the Admin Console that was needed. TimelineThis issue was discovered during a security review on 16 September 2021. Patched versions were released on 23 September 2021. This advisory was published on 21 October 2021. The CVE Numbering Authority (CNA) notified Replicated on 23 January 2025 that the CVE was still in Reserved But Public (RBP) status. Upon discovering the oversight in updating the status to published with the CNA, Replicated submitted the updated report on the same day, 23 January 2025.

MediumCVSS 4.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-42718 is an authenticated information disclosure issue in Replicated Classic before 2.53.1. An admin-console user could retrieve API data containing container environment variables, which might include application secrets. The issue was fixed in 2021, and Replicated Classic reached end of life on December 31, 2024.

Executive priority

Treat this as a targeted cleanup and legacy-risk item, not an emergency internet-scale incident. Prioritize any remaining Replicated Classic deployments because exposed secrets can have broad downstream impact, and the product is no longer supported.

Technical view

The Admin Console API on port 8800 returned container definitions including environment variables to authenticated users with Admin Console access. Depending on application manifests, those values could include passwords or other secrets. Replicated removed sensitive data from the API response in version 2.53.1.

Likely exposure

Exposure is limited to organizations running Replicated Classic before 2.53.1, especially 2.53.0 as listed, with reachable Admin Console port 8800 and users who have valid Admin Console credentials. Current exposure should be rare but important because the product is now end of life.

Exploitation context

The source bundle does not show KEV listing or active exploitation. Abuse requires authenticated Admin Console access, so this is not described as unauthenticated internet-wide exploitation. The main risk is insider misuse, compromised admin credentials, or overly broad console access.

Researcher notes

The advisory says the issue was found during a security review on September 16, 2021, patched on September 23, 2021, and published by Replicated on October 21, 2021. CNA publication occurred in January 2025 due to prior RBP status. No exploit evidence is provided.

Mitigation direction

  • Upgrade Replicated Classic to 2.53.1 or later if still in use.
  • Retire or replace Replicated Classic because support ended December 31, 2024.
  • Restrict Admin Console port 8800 to trusted administrative networks.
  • Review and rotate secrets that may have appeared in environment variables.
  • Check Replicated guidance for any product-specific remediation constraints.

Validation and detection

  • Inventory Replicated Classic deployments and record their versions.
  • Confirm no deployment is running a version before 2.53.1.
  • Check whether Admin Console port 8800 is reachable beyond trusted administrators.
  • Review application manifests for secrets stored in environment variables.
  • Audit Admin Console access for unnecessary or stale privileged accounts.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-922: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-42718 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.9 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.9CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N1.23.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.9Medium
CVSS 3.1 vector shape for CVE-2021-42718Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
ReplicatedReplicated Classic2.53.0unaffected
Weakness

CWE details

CWE-922

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-922 · source CWE mapping

Insecure Storage of Sensitive Information

Insecure Storage of Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs