CVE-2021-32639

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the `RegisterPeerAction` endpoint and the `AddChildDirectoryAction` endpoint are vulnerable to SSRF. This vulnerability may lead to credential leaks. Emissary version 7.0 contains a patch. As a workaround, disable network access to Emissary from untrusted sources.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jul 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-32647.2SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php.CVE-2021-326405.3ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can b CVE-2021-326416.1auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker c CVE-2021-326429.4radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validation in radsecproxy's `CVE-2021-326435.8Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme i CVE-2021-326445.4Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are CVE-2021-326456.1Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have ope CVE-2021-326467.3Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vuln CVE-2021-326479.1Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Executi CVE-2021-326489.1octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request CVE-2021-326498.8October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.CVE-2021-326508.8October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.