CVE-2021-27181

An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user.

• CWE-352

• https://github.com/chudyPB/MDaemon-AdvisoriesExploit, Third Party Advisory
• https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/Release Notes, Vendor Advisory
• https://github.com/chudyPB/MDaemon-AdvisoriesExploit, Third Party Advisory
• https://www.altn.com/Support/SecurityUpdate/MD011221_MDaemon_EN/Release Notes, Vendor Advisory

Published

Apr 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27175An issue was discovered on FiberHome HG6245D devices through…7.5
• CVE-2021-27176An issue was discovered on FiberHome HG6245D devices through…7.5
• CVE-2021-27177An issue was discovered on FiberHome HG6245D devices through…9.8
• CVE-2021-27178An issue was discovered on FiberHome HG6245D devices through…7.5
• CVE-2021-27179An issue was discovered on FiberHome HG6245D devices through…7.5
• CVE-2021-27180An issue was discovered in MDaemon before 20.0.4. There is R…6.1
• CVE-2021-27182An issue was discovered in MDaemon before 20.0.4. There is a…8.8
• CVE-2021-27183An issue was discovered in MDaemon before 20.0.4. Administra…7.2
• CVE-2021-27184Pelco Digital Sentry Server 7.18.72.11464 has an XML Externa…7.5
• CVE-2021-27185The samba-client package before 4.0.0 for Node.js allows com…9.8
• CVE-2021-27186Fluent Bit 1.6.10 has a NULL pointer dereference when an flb…7.5
• CVE-2021-27187The Sovremennye Delovye Tekhnologii FX Aggregator terminal c…7.5