CVE-2021-29357

8.6 highEPSS 1.0%

High (8.6) in outsystems. EPSS 1.0% chance of exploitation in the next 30 days.

The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbound HTTP requests.

Severity

CVSS 3.1

8.6 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2021-04-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

outsystems:lifetime_management_console
outsystems:outsystems
outsystems:platform_server

References

https://labs.integrity.pt/advisories/cve-2021-29357/
https://success.outsystems.com/Support/Security/Vulnerabilities/Vulnerability_RTAF-2226
https://labs.integrity.pt/advisories/cve-2021-29357/
https://success.outsystems.com/Support/Security/Vulnerabilities/Vulnerability_RTAF-2226

Check your stack JSON