Vulnerability · Published Jan 17, 2022 · Assigned by apache
CVE-2021-42357DOM based XSS Vulnerability in Apache Knox
Medium 6.1
In plain English
A medium-severity cross-site scripting in Apache Knox from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.knox:gateway-service-knoxsso | 1.6.1 | GHSA-vv38-4xcj-q4rw |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Knox | Apache Knox 1.x – before 1.6.10.12.0 – before Apache Knox 0.x* |
Weakness: CWE-79
References
- https://lists.apache.org/thread/b7v5dkpyqb51nw0lvz4cybhgrfhk1g7j x_refsource_MISC
- [oss-security] 20220117 CVE-2021-42357: DOM based XSS Vulnerability in Apache Knox mailing-list, x_refsource_MLIST