CVE-2021-21354— Open redirect in pollbot
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-21354
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open redirect in pollbot
Source: CVE Program / CVE List V5
Vulnerability Description
Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things during the Firefox release process." In Pollbot before version 1.4.4 there is an open redirection vulnerability in the path of "https://pollbot.services.mozilla.com/". An attacker can redirect anyone to malicious sites. To Reproduce type in this URL: "https://pollbot.services.mozilla.com//evil.com/". Affected versions will redirect to that website when you inject a payload like "//evil.com/". This is fixed in version 1.4.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
Pollbot 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ben Hearsum PollBot是 （Ben Hearsum）开源的一个应用软件。提供一个勤奋的小型机器人，可将其人类主人从繁琐的Firefox发布过程中轮询事物状态的繁琐任务中解放出来。 Pollbot 存在安全漏洞，该漏洞源于pollbot.services.mozilla.com路径下存在一个打开的重定向漏洞。攻击者可利用该漏洞可以将任何人重定向到恶意网站。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-21354
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-21354
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-21354 (2)
- https://github.com/mozilla/PollBot/pull/333x_refsource_MISC
Vendor Advisories for CVE-2021-21354 (2)
- https://bugzilla.mozilla.org/show_bug.cgi?id=1694684x_refsource_MISC
- https://github.com/mozilla/PollBot/security/advisories/GHSA-jhgx-wmq8-jc24x_refsource_CONFIRM
Other References for CVE-2021-21354 (2)
- https://github.com/mozilla/PollBot/releases/tag/v1.4.4x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: mozilla
- CVE-2026-18809
Information disclosure in Firefox for Android and Firefox Fo - CVE-2026-14899
Off-by-one out of bounds read in MIME header parser for forw - CVE-2026-16361
Memory safety bugs fixed in Thunderbird ESR 140.13 - CVE-2026-16360
Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR - CVE-2026-16412
Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 1
Same weakness: CWE-601
- CVE-2026-14219
URL Redirection in Bilin Software's HUMANIST Digital Human R - CVE-2026-18721
kalcaddle kodbox SSO API Login apiLogin redirect - CVE-2026-69087
Grav Form Plugin before 9.1.13 Open Redirect via form.value( - CVE-2025-71403
better-auth before 1.1.20 Open Redirect via trustedOrigins B - CVE-2026-53573
core-geonetwork has an Open Redirect Bypass
V. Comments for CVE-2021-21354
No comments yet