CVE-2021-29995

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the logged-in user (including script execution). The issue is resolved in CloverDX 5.10, CloverDX 5.9.1, CloverDX 5.8.2, and CloverDX 5.7.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/163697/CloverDX-5.9.0-Code-Execution-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
https://support.cloverdx.com/releases/Release Notes, Vendor Advisory
https://support1.cloverdx.com/hc/en-us/articles/360021006520Vendor Advisory
http://packetstormsecurity.com/files/163697/CloverDX-5.9.0-Code-Execution-Cross-Site-Request-Forgery.htmlExploit, Third Party Advisory, VDB Entry
https://support.cloverdx.com/releases/Release Notes, Vendor Advisory
https://support1.cloverdx.com/hc/en-us/articles/360021006520Vendor Advisory

Timeline

Published: Jun 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-299969.6Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution (RCE) by opening .md files c CVE-2021-299975.3An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.CVE-2021-299989.8An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client.CVE-2021-299999.8An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.CVE-2021-300009.8An issue was discovered in LATRIX 0.6.0. SQL injection in the txtaccesscode parameter of inandout.php leads to information disclosure and co CVE-2021-300026.2An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.CVE-2021-300034.8An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface via urlfilter.cgi?add CVE-2021-300045.3In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x5 CVE-2021-300057.8In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS.CVE-2021-300067.5In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.CVE-2021-300145.5There is a integer overflow in media_tools/av_parsers.c in the hevc_parse_slice_segment function in GPAC from v0.9.0-preview to 1.0.1 which CVE-2021-300155.5There is a Null Pointer Dereference in function filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal in GPAC 1.0.1. The pid comes from