CVE-2021-42074

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Barrier before 2.3.4. An unauthenticated attacker can cause a segmentation fault in the barriers component (aka the server-side implementation of Barrier) by quickly opening and closing TCP connections while sending a Hello message for each TCP session.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2021/11/02/4Exploit, Mailing List, Third Party Advisory
https://github.com/debauchee/barrier/releases/tag/v2.3.4Release Notes, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/11/02/4Exploit, Mailing List, Third Party Advisory
https://github.com/debauchee/barrier/releases/tag/v2.3.4Release Notes, Third Party Advisory

Timeline

Published: Nov 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-420757.5An issue was discovered in Barrier before 2.3.4. The barriers component (aka the server-side implementation of Barrier) does not correctly c CVE-2021-420767.5An issue was discovered in Barrier before 2.3.4. An attacker can cause memory exhaustion in the barriers component (aka the server-side impl CVE-2021-420779.8PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter. This can CVE-2021-420786.1PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php t CVE-2021-420794.9An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. CVE-2021-42087.2The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statemen CVE-2021-420807.4An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/e CVE-2021-420817.2An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storag CVE-2021-420827.8Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qsto CVE-2021-420835.4An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITS CVE-2021-420846.5An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted requests that cause an CVE-2021-420855.4An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.