CVE-2021-21742

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	ZTE Axon 30 Pro Message Service App	5.3.1.2103091059

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019084Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019084Vendor Advisory

Timeline

Published: Sep 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-217434.3ZTE MF971R product has a CRLF injection vulnerability. An attacker could exploit the vulnerability to modify the HTTP response header inform CVE-2021-217447.5ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify the configuration para CVE-2021-217454.3ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to CVE-2021-217466.1ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.CVE-2021-217476.1ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.CVE-2021-217489.8ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary c CVE-2021-217499.8ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary c CVE-2021-21752.7Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c an CVE-2021-217507.8ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task modification privilege,CVE-2021-217518.1ZTE BigVideo analysis product has an input verification vulnerability. Due to the inconsistency between the front and back verifications whe CVE-2021-217710.0Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Gateway). The supported version that is affec CVE-2021-217728.1A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially