CVE-2021-28113

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Apr 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-281145.4Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.CVE-2021-281156.1The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.CVE-2021-281165.3Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP pro CVE-2021-281177.5libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (tha CVE-2021-281199.8Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC message to the expo CVE-2021-281219.8Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.CVE-2021-281229.8A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to CVE-2021-281239.8Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6 CVE-2021-281245.9A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6 CVE-2021-281256.1Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input fo CVE-2021-281266.1index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability CVE-2021-281277.5An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.