{"schema":"mvm.security.app-comparison-report/v1","source_run_id":"cve-2021-21315-tier1","artifact_digest":"sha256:08db6c24fef18ce1e49b1b1473627e89591a9b7a7caef93169408b504adf71ae","authorization_id":"cve-corpus-local-lab","identity_binding":"operator_declared_baseline_plus_receipt_bound_mvm_trial","boundary_evidence_certifying":false,"security_conclusion":"EXPLOITABLE_MVM_BENEFIT_NOT_PROVEN","headline":"Your app is exploitable; MVM protection is not yet proven","boundary_claim":false,"proof_id":"cve-2021-21315-tier1","trial_id":"cve-2021-21315-local","proof_binding_digest":"sha256:66ce0dc5097008c95c185035afb4bda59a9701ed1363ebbfe95a5bc8358b21d4","observation_digest":"sha256:06bc91d521d20ae33817e5a69aa31df45c8d0588eec335518421ba6adcd5d506","baseline":{"label":"systeminformation-5.3.0-without-mvm","base_url":"http://127.0.0.1:52251","artifact_digest":"sha256:08db6c24fef18ce1e49b1b1473627e89591a9b7a7caef93169408b504adf71ae","mvm_id":null},"mvm":{"label":"systeminformation-5.3.0-tier1-loopback","base_url":"http://127.0.0.1:52252","artifact_digest":"sha256:08db6c24fef18ce1e49b1b1473627e89591a9b7a7caef93169408b504adf71ae","mvm_id":"tier1-non-certifying"},"comparisons":[{"probe_id":"bounded-command-injection-canary","campaign_id":"cve-2021-21315-process-exec","finding_id":"CVE-2021-21315","title":"Array parameter bypass reaches a fixed canary write","risk":"active_bounded","baseline":{"status":200,"response_bytes":32,"response_digest":"sha256:ab57e21f37e37c1b2ce3b6fd9ec1bf1d30ff3a99b98cc41c80bf43d07bd29758","vulnerable_signal":true,"elapsed_ms":62,"error":null},"mvm":{"status":200,"response_bytes":32,"response_digest":"sha256:ab57e21f37e37c1b2ce3b6fd9ec1bf1d30ff3a99b98cc41c80bf43d07bd29758","vulnerable_signal":true,"elapsed_ms":54,"error":null},"delta":"UNCHANGED_VULNERABLE","boundary_outcome":"INCONCLUSIVE","boundary_evidence_refs":["mvm:proof:sha256:66ce0dc5097008c95c185035afb4bda59a9701ed1363ebbfe95a5bc8358b21d4","mvm:observation:sha256:06bc91d521d20ae33817e5a69aa31df45c8d0588eec335518421ba6adcd5d506"]}],"limitations":["The baseline exploit was reproduced, but matching certifying PREVENTED or CONTAINED evidence is missing for one or more reproduced exploits.","Baseline artifact equality remains operator-declared; MVM outcomes apply only to the exact campaign, artifact, policy, and evidence references joined here.","Endpoint state and request timing can differ; repeat trials before attributing a delta."]}