CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-38384
Critical (9.8) in serverless offline project serverless offline. EPSS 1.5% chance of exploitation in the next 30 days.
Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- CWE
- CWE-755
- Published
- Modified
- Record from
- the NVD, synced
Affected
- serverless_offline_project:serverless_offline
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h97f-5258-5593 | npm | serverless-offline | <=8.0.0 | no fix published |