CVE-2021-3851

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

firefly-iii is vulnerable to URL Redirection to Untrusted Site

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
firefly-iiifirefly-iii/firefly-iii>= unspecified, < 5.6.2

References

Timeline

Published
Oct 19, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-385108.8The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run commands on a user's CVE-2021-385117.5An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitraryCVE-2021-385127.5An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leadCVE-2021-385139.8Certain NETGEAR devices are affected by authentication bypass. This affects RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before CVE-2021-385142.7Certain NETGEAR devices are affected by authentication bypass. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, D6100 before 1.0.0CVE-2021-385157.5Certain NETGEAR devices are affected by denial of service. This affects R6400v2 before 1.0.4.98, R6700v3 before 1.0.4.98, R7900 before 1.0.3CVE-2021-385169.8Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0CVE-2021-385177.2Certain NETGEAR devices are affected by out-of-bounds reads and writes. This affects R6400 before 1.0.1.70, RAX75 before 1.0.4.120, RAX80 beCVE-2021-385187.2Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RAX200 before 1.0.4.120, RAX75 before 1.0.4CVE-2021-385197.2Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6250 before 1.0.4.36, R6300v2 before 1.0.4CVE-2021-38527.5growi is vulnerable to Authorization Bypass Through User-Controlled KeyCVE-2021-385207.2Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.52, R6400v2 before 1.0.4
CVE-2021-3851: Medium severity, CVSS 5.4 | Vulnix