CVE-2021-43410
Last modified
CVE-2021-43410 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. EPSS estimates a 2.39% chance of exploitation in the next 30 days.
Description
Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affected: master branch before commit 3c5d8c7 [1] of airavata-django-portal [1] https://github.com/apache/airavata-django-portal/commit/3c5d8c72bfc3eb0af8693a655a5d60f9273f8170
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Airavata Django Portal | < 2021-12-06 |
References
- https://lists.apache.org/thread/q64h16ofdxk29soz3jj561nysnzcrl31Mailing List, Vendor Advisory
- https://lists.apache.org/thread/q64h16ofdxk29soz3jj561nysnzcrl31Mailing List, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-43410?
How severe is CVE-2021-43410?
How do I fix CVE-2021-43410?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-43404An issue was discovered in FusionPBX before 4.5.30. The FAX …8.8
- CVE-2021-43405An issue was discovered in FusionPBX before 4.5.30. The fax_…8.8
- CVE-2021-43406An issue was discovered in FusionPBX before 4.5.30. The fax_…8.8
- CVE-2021-43408The "Duplicate Post" WordPress plugin up to and including ve…8.8
- CVE-2021-43409The “WPO365 | LOGIN” WordPress plugin (up to and including v…6.1
- CVE-2021-4341The uListing plugin for WordPress is vulnerable to authoriza…9.8
- CVE-2021-43411An issue was discovered in GNU Hurd before 0.9 20210404-9. W…7.5
- CVE-2021-43412An issue was discovered in GNU Hurd before 0.9 20210404-9. l…7.8
- CVE-2021-43413An issue was discovered in GNU Hurd before 0.9 20210404-9. A…8.8
- CVE-2021-43414An issue was discovered in GNU Hurd before 0.9 20210404-9. T…7
- CVE-2021-43415HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, an…8.8
- CVE-2021-43419An Information Disclosure vulnerability exists in Opay Mobil…7.5
Are you affected by CVE-2021-43410?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST