CVE-2021-4138

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
May 2, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-413806.5RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data. NOTE: It iCVE-2021-413817.5Payara Micro Community 5.2021.6 and below allows Directory Traversal.CVE-2021-413827.5Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.CVE-2021-413837.2setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_server fCVE-2021-413856.5The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295_0302 allows an authenticated user to obtain access to server coCVE-2021-413878.8seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root.CVE-2021-413887.8Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc pCVE-2021-41399.0pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-413908.0In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV InjCVE-2021-413915.4In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSCVE-2021-413929.8static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to theCVE-2021-413939.8Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations
CVE-2021-4138: Medium severity, CVSS 5.3 | Vulnix