CVE-2021-4294

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-208 CWE-203

Affected software

Vendor	Product	Versions
OpenShift	OSIN	n/a

References

https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29Patch
https://github.com/openshift/osin/pull/200Issue Tracking
https://vuldb.com/?ctiid.216987Permissions Required
https://vuldb.com/?id.216987Permissions Required
https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29Patch
https://github.com/openshift/osin/pull/200Issue Tracking
https://vuldb.com/?ctiid.216987Permissions Required
https://vuldb.com/?id.216987Permissions Required

Timeline

Published: Dec 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-429409.9A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upl CVE-2021-429435.4Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML CVE-2021-429459.8A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.CVE-2021-429464.8A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.CVE-2021-429483.7HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, al CVE-2021-429499.8The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attack CVE-2021-42959.8A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabula CVE-2021-429508.8Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an a CVE-2021-429518.8A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for a CVE-2021-429529.9Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, use CVE-2021-429547.8Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation direc CVE-2021-429557.8Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability