CVE-2021-27229

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mumble-voip/mumble/commit/e59ee87abe249f345908c7d568f6879d16bfd648Patch, Third Party Advisory
https://github.com/mumble-voip/mumble/compare/1.3.3...1.3.4Patch, Third Party Advisory
https://github.com/mumble-voip/mumble/pull/4733Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00022.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202105-13Third Party Advisory
https://github.com/mumble-voip/mumble/commit/e59ee87abe249f345908c7d568f6879d16bfd648Patch, Third Party Advisory
https://github.com/mumble-voip/mumble/compare/1.3.3...1.3.4Patch, Third Party Advisory
https://github.com/mumble-voip/mumble/pull/4733Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00022.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202105-13Third Party Advisory

Timeline

Published: Feb 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-272308.8ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save CVE-2021-272315.4Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for CVE-2021-272328.8The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overf CVE-2021-272334.9An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, password information for externa CVE-2021-272349.8An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. The web application suffers from SQL injection on Adminlog.asp, Archivemsgs.CVE-2021-272354.9An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, there is a functionality at diag CVE-2021-272369.8An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be levera CVE-2021-272374.8The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax_save.php.CVE-2021-272398.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware CVE-2021-272407.8This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. An attacker CVE-2021-272416.1This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Bui CVE-2021-272428.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker mu