CVE-2021-40683

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://akamai.com/blog/news/eaa-client-escalation-of-privilege-vulnerabilityExploit, Vendor Advisory
https://www.akamai.com/products/enterprise-application-accessProduct, Vendor Advisory
https://akamai.com/blog/news/eaa-client-escalation-of-privilege-vulnerabilityExploit, Vendor Advisory
https://www.akamai.com/products/enterprise-application-accessProduct, Vendor Advisory

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-406849.1Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint CVE-2021-40697.8vim is vulnerable to Use After Free CVE-2021-406907.5All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" pr CVE-2021-406914.3A session hijack risk was identified in the Shibboleth authentication plugin.CVE-2021-406924.3Insufficient capability checks made it possible for teachers to download users outside of their courses.CVE-2021-406936.5An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.CVE-2021-406944.9Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system accou CVE-2021-406954.3It was possible for a student to view their quiz grade before it had been released, using a quiz web service.CVE-2021-406973.3Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerab CVE-2021-406987.4ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vu CVE-2021-406997.4ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability w CVE-2021-40709.1Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.