CVE-2021-42072

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Barrier before 2.4.0. The barriers component (aka the server-side implementation of Barrier) does not sufficiently verify the identify of connecting clients. Clients can thus exploit weaknesses in the provided protocol to cause denial-of-service or stage further attacks that could lead to information leaks or integrity corruption.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2021/11/02/4Exploit, Mailing List, Third Party Advisory
https://github.com/debauchee/barrier/releases/tag/v2.4.0Release Notes, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIEVNCFEFO7L3NTM4VUZB3WKYYCBTFCI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMU3STOKHPEZSC54MZ42YBFFC2R3BU2Q/
http://www.openwall.com/lists/oss-security/2021/11/02/4Exploit, Mailing List, Third Party Advisory
https://github.com/debauchee/barrier/releases/tag/v2.4.0Release Notes, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIEVNCFEFO7L3NTM4VUZB3WKYYCBTFCI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMU3STOKHPEZSC54MZ42YBFFC2R3BU2Q/

Timeline

Published: Nov 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-420738.2An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-s CVE-2021-420747.5An issue was discovered in Barrier before 2.3.4. An unauthenticated attacker can cause a segmentation fault in the barriers component (aka t CVE-2021-420757.5An issue was discovered in Barrier before 2.3.4. The barriers component (aka the server-side implementation of Barrier) does not correctly c CVE-2021-420767.5An issue was discovered in Barrier before 2.3.4. An attacker can cause memory exhaustion in the barriers component (aka the server-side impl CVE-2021-420779.8PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can CVE-2021-420786.1PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php t CVE-2021-420794.9An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. CVE-2021-42087.2The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statemen CVE-2021-420807.4An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/e CVE-2021-420817.2An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storag CVE-2021-420827.8Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qsto CVE-2021-420835.4An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITS