CVE-2021-4430

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6. This affects an unknown part of the file src/defaultConfig.js of the component ENV Variable Handler. The manipulation leads to information disclosure. Upgrading to version 3.1.7 is able to address this issue. The identifier of the patch is a3aa62daea2e44c76d08d1eac63768cd928cd69e. It is recommended to upgrade the affected component. The identifier VDB-244485 was assigned to this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Ortus Solutions	ColdBox Elixir	3.1.6

References

https://github.com/Ortus-Solutions/coldbox-elixir/commit/a3aa62daea2e44c76d08d1eac63768cd928cd69ePatch
https://github.com/Ortus-Solutions/coldbox-elixir/releases/tag/v3.1.7Release Notes
https://vuldb.com/?ctiid.244485Permissions Required, VDB Entry
https://vuldb.com/?id.244485Permissions Required, VDB Entry
https://github.com/Ortus-Solutions/coldbox-elixir/commit/a3aa62daea2e44c76d08d1eac63768cd928cd69ePatch
https://github.com/Ortus-Solutions/coldbox-elixir/releases/tag/v3.1.7Release Notes
https://vuldb.com/?ctiid.244485Permissions Required, VDB Entry
https://vuldb.com/?id.244485Permissions Required, VDB Entry

Timeline

Published: Nov 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-443028.8BaiCloud-cms v2.5.7 was discovered to contain multiple SQL injection vulnerabilities via the tongji and baidu_map parameters in /user/ztconf CVE-2021-44316.1A vulnerability classified as problematic has been found in msyk FMDataAPI up to 22. Affected is an unknown function of the file FMDataAPI_S CVE-2021-443104.8An issue was discovered in Firmware Analysis and Comparison Tool v3.2. With administrator privileges, the attacker could perform stored XSS CVE-2021-443128.8An issue was discovered in Firmware Analysis and Comparison Tool v3.2. Logged in administrators could be targeted by a CSRF attack through v CVE-2021-443157.5In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive f CVE-2021-443175.4In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability.CVE-2021-443197.5Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication a CVE-2021-44327.5A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as problematic. This affects an unknown part of the component US CVE-2021-443207.5Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the de CVE-2021-443215.0Mini-Inventory-and-Sales-Management-System is affected by Cross Site Request Forgery (CSRF), where an attacker can update/delete items in th CVE-2021-44337.5A vulnerability was found in Karjasoft Sami HTTP Server 2.0. It has been classified as problematic. Affected is an unknown function of the c CVE-2021-443317.8ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode_ise().