Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2021-23336— Web Cache Poisoning

CVSS 5.9 · Medium EPSS 0.30% · P53
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2021-23336

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Web Cache Poisoning
Source: NVD (National Vulnerability Database)
Vulnerability Description
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
cpython 环境问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
cpython是Python基金会的用C语言实现的Python解释器。 cpython 存在环境问题漏洞，攻击者可利用该漏洞可以使用分号(;)分隔查询参数，导致恶意请求被缓存为完全安全的请求。以下产品及版本受到影响：before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-python/cpython 0 ~ unspecified -

II. Public POCs for CVE-2021-23336

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-23336

请登录查看更多情报信息。

Same Patch Batch · n/a · 2021-02-15 · 28 CVEs total

CVE-2021-233377.2 HIGHCommand Injection
CVE-2021-233386.6 MEDIUMDeserialization of Untrusted Data
CVE-2020-285005.3 MEDIUMRegular Expression Denial of Service (ReDoS)
CVE-2020-24899Nagios XI和Nagios 命令注入漏洞
CVE-2021-26822Teachers Record Management System SQL注入漏洞
CVE-2020-35734Batflat 注入漏洞
CVE-2021-26201CASAP Automated Enrollment SQL注入漏洞
CVE-2021-26200SourceCodester user area for Library System SQL注入漏洞
CVE-2021-3239Sourcecodester Pisay Online E-Learning System SQL注入漏洞
CVE-2020-29143OpenEMR SQL注入漏洞
CVE-2020-29139OpenEMR SQL注入漏洞
CVE-2020-29140OpenEMR SQL注入漏洞
CVE-2020-29142OpenEMR SQL注入漏洞
CVE-2020-28337Microweber 路径遍历漏洞
CVE-2021-27211Steghide 安全漏洞
CVE-2021-27201Endian Firewall Community 操作系统命令注入漏洞
CVE-2021-3375Atomi ActivePresenter 缓冲区错误漏洞
CVE-2021-25296Nagios XI 安全漏洞
CVE-2020-22427Nagios XI 代码注入漏洞
CVE-2020-22425Centreon SQL注入漏洞

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: n/a

V. Comments for CVE-2021-23336

No comments yet

Leave a comment