CVE-2021-42357

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.

• CWE-79
• CWE-79

• http://www.openwall.com/lists/oss-security/2022/01/17/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread/b7v5dkpyqb51nw0lvz4cybhgrfhk1g7jMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/01/17/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread/b7v5dkpyqb51nw0lvz4cybhgrfhk1g7jMailing List, Vendor Advisory

Published

Jan 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4234OpenVPN Access Server 2.10 and prior versions are susceptibl…7.5
• CVE-2021-42340The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to …7.5
• CVE-2021-42341checkpath in OpenRC before 0.44.7 uses the direct output of …7.5
• CVE-2021-42342An issue was discovered in GoAhead 4.x and 5.x before 5.1.5.…9.8
• CVE-2021-42343An issue was discovered in the Dask distributed package befo…9.8
• CVE-2021-4235Due to unbounded alias chasing, a maliciously crafted YAML f…5.5
• CVE-2021-42358The Contact Form With Captcha WordPress plugin is vulnerable…8.8
• CVE-2021-42359WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-d…9.1
• CVE-2021-4236Web Sockets do not execute any AuthenticateMethod methods wh…9.8
• CVE-2021-42360On sites that also had the Elementor plugin for WordPress in…5.4
• CVE-2021-42361The Contact Form Email WordPress plugin is vulnerable to Sto…4.8
• CVE-2021-42362The WordPress Popular Posts WordPress plugin is vulnerable t…8.8