CVE-2021-32827

MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trick a victim into visiting a malicious site while running MockServer locally, will be able to run arbitrary code on the MockServer machine. With an overly broad default CORS configuration MockServer allows any site to send cross-site requests. Additionally, MockServer allows you to create dynamic expectations using Javascript or Velocity templates. Both engines may allow an attacker to execute arbitrary code on-behalf of MockServer. By combining these two issues (Overly broad CORS configuration + Script injection), an attacker could serve a malicious page so that if a developer running MockServer visits it, they will get compromised. For more details including a PoC see the referenced GHSL-2021-059.

• CWE-74
• CWE-79

• https://securitylab.github.com/advisories/GHSL-2021-059-mockserver/Exploit, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2021-059-mockserver/Exploit, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory

Published

Aug 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32821MooTools is a collection of JavaScript utilities for JavaScr…7.5
• CVE-2021-32822The npm hbs package is an Express view engine wrapper for Ha…5.3
• CVE-2021-32823In the bindata RubyGem before version 2.4.10 there is a pote…3.7
• CVE-2021-32824Apache Dubbo is a java based, open source RPC framework. Ver…9.8
• CVE-2021-32825bblfshd is an open source self-hosted server for source code…9.1
• CVE-2021-32826Proxyee-Down is open source proxy software. An attacker bein…8.1
• CVE-2021-32828The Nuxeo Platform is an open source content management plat…6.1
• CVE-2021-32829ZStack is open source IaaS(infrastructure as a service) soft…9.9
• CVE-2021-3283HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and j…7.5
• CVE-2021-32830The @diez/generation npm package is a client for Diez. The l…7
• CVE-2021-32831Total.js framework (npm package total.js) is a framework for…7.2
• CVE-2021-32832Rocket.Chat is an open-source fully customizable communicati…6.5