CVE-2021-29238

CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF).

• CWE-352

• https://customers.codesys.com/index.phpPermissions Required, Vendor Advisory
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14638&token=30b75ee95d0d94527894dfd8cdc5432575a8eff8&download=Vendor Advisory
• https://www.codesys.com/security/security-reports.htmlVendor Advisory
• https://customers.codesys.com/index.phpPermissions Required, Vendor Advisory
• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14638&token=30b75ee95d0d94527894dfd8cdc5432575a8eff8&download=Vendor Advisory
• https://www.codesys.com/security/security-reports.htmlVendor Advisory

Published

May 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29216A remote cross-site scripting vulnerability was discovered i…6.1
• CVE-2021-29217A remote URL redirection vulnerability was discovered in HPE…6.1
• CVE-2021-29218A local unquoted search path security vulnerability has been…6.7
• CVE-2021-29219A potential local buffer overflow vulnerability has been ide…7.8
• CVE-2021-29220Multiple buffer overflow security vulnerabilities have been …7.2
• CVE-2021-29221A local privilege escalation vulnerability was discovered in…7
• CVE-2021-29239CODESYS Development System 3 before 3.5.17.0 displays or exe…7.8
• CVE-2021-29240The Package Manager of CODESYS Development System 3 before 3…7.8
• CVE-2021-29241CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer derefe…7.5
• CVE-2021-29242CODESYS Control Runtime system before 3.5.17.0 has improper …7.3
• CVE-2021-29243Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XS…6.1
• CVE-2021-29245BTCPay Server through 1.0.7.0 uses a weak method Next to pro…5.3