CVE-2021-42357: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

January 17, 2022 (updated January 24, 2022)

When using Apache Knox SSO, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.

References

www.openwall.com/lists/oss-security/2022/01/17/2
lists.apache.org/thread/b7v5dkpyqb51nw0lvz4cybhgrfhk1g7j
nvd.nist.gov/vuln/detail/CVE-2021-42357

Code Behaviors & Features

Detect and mitigate CVE-2021-42357 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →