cve.bz

CVE-2021-42357

6.1 mediumEPSS 2.6%

Medium (6.1) in apache knox. EPSS 2.6% chance of exploitation in the next 30 days. Fixed in org.apache.knox:gateway-service-knoxsso 1.6.1.

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-vv38-4xcj-q4rwMavenorg.apache.knox:gateway-service-knoxsso<1.6.11.6.1

References

Check your stackJSON