CVE-2021-41123

Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments. Starting from version 21.09.1 the endpoint is turned off by default.

• CWE-200

• https://github.com/surveysolutions/surveysolutions/commit/99e7e8345cb98f2eda08e37976e3d3aeb49971c9Patch, Third Party Advisory
• https://github.com/surveysolutions/surveysolutions/security/advisories/GHSA-6c7j-7jf3-9p3jThird Party Advisory
• https://github.com/surveysolutions/surveysolutions/commit/99e7e8345cb98f2eda08e37976e3d3aeb49971c9Patch, Third Party Advisory
• https://github.com/surveysolutions/surveysolutions/security/advisories/GHSA-6c7j-7jf3-9p3jThird Party Advisory

Published

Oct 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41118The DynamicPageList3 extension is a reporting tool for Media…7.5
• CVE-2021-41119Wire-server is the system server for the wire back-end servi…7.5
• CVE-2021-4112A flaw was found in ansible-tower where the default installa…8.8
• CVE-2021-41120sylius/paypal-plugin is a paypal plugin for the Sylius devel…7.5
• CVE-2021-41121Vyper is a Pythonic Smart Contract Language for the EVM. In …8.8
• CVE-2021-41122Vyper is a Pythonic Smart Contract Language for the EVM. In …4.3
• CVE-2021-41124Scrapy-splash is a library which provides Scrapy and JavaScr…7.5
• CVE-2021-41125Scrapy is a high-level web crawling and scraping framework f…6.5
• CVE-2021-41126October is a Content Management System (CMS) and web platfor…7.2
• CVE-2021-41127Rasa is an open source machine learning framework to automat…7.1
• CVE-2021-41128Hygeia is an application for collecting and processing perso…8.8
• CVE-2021-41129Pterodactyl is an open-source game server management panel b…8.1