Vulnerability · Published May 2, 2022 · Assigned by mozilla
CVE-2021-4138
Medium 5.3
In plain English
A medium-severity security flaw in geckodriver from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)0.8%top 41.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | geckodriver | unspecified – before 0.30.0 |
References
- https://github.com/mozilla/geckodriver/releases/tag/v0.30.0 x_refsource_MISC
- https://bugzilla.mozilla.org/show_bug.cgi?id=1652612 x_refsource_MISC