CVE-2021-23336

medium · 5.9

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

5.9

CVSS

36.0%

EPSS (exploit prob.)

98th

EPSS percentile

2021-02-15

Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

Weaknesses

CWE-444

Affected products

Vendor	Product	Affected versions
python	python	< 3.6.13
python	python	>= 3.7.0, < 3.7.10
python	python	>= 3.8.0, < 3.8.8
python	python	>= 3.9.0, < 3.9.2
fedoraproject	fedora	32
fedoraproject	fedora	33
fedoraproject	fedora	34
debian	debian_linux	9.0
netapp	cloud_backup	all versions
netapp	inventory_collect_tool	all versions
netapp	ontap_select_deploy_administration_utility	all versions
netapp	snapcenter	all versions
djangoproject	django	>= 2.2, < 2.2.19
djangoproject	django	>= 3.0, < 3.0.13
djangoproject	django	>= 3.1, < 3.1.7
oracle	communications_offline_mediation_controller	12.0.0.3.0
oracle	communications_pricing_design_center	12.0.0.3.0
oracle	enterprise_manager_ops_center	12.4.0.0
oracle	zfs_storage_appliance	8.8

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-23336