CVE-2021-32647

🗓️ 28 May 2021 23:05:10Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 84 Views🌐 WEB

Emissary RCE vulnerability in `CreatePlace` REST endpoin

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2021-32647	1 Jun 202114:15	–	attackerkb
CNNVD	Emissary injection vulnerability	1 Jun 202100:00	–	cnnvd
Cvelist	CVE-2021-32647 Post-authentication Remote Code Execution (RCE) in emissary:emissary	28 May 202123:05	–	cvelist
EUVD	EUVD-2021-19470	7 Oct 202500:30	–	euvd
Mend	CVE-2021-32647	28 May 202123:05	–	mend
NVD	CVE-2021-32647	1 Jun 202114:15	–	nvd
osv_cve	CVE-2021-32647	1 Jun 202114:15	–	osv_cve
Prion	Design/Logic Flaw	1 Jun 202114:15	–	prion
Positive Technologies	PT-2021-19829	28 May 202100:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2021-32647: Improper Neutralization of Special Elements in Output Used by a Downstream Component	28 May 202100:00	–	rapid7

NVD

Vulners

Node

nsa emissaryMatch6.4.0

[
  {
    "product": "emissary",
    "vendor": "NationalSecurityAgency",
    "versions": [
      {
        "status": "affected",
        "version": "= 6.4.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-ph73-7v9r-wg32
github	www.github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java

Parameter	Position	Path	Description	CWE
sppClassName	query param	/CreatePlace	The /CreatePlace REST endpoint accepts an 'sppClassName' parameter which is used to load an arbitrary class, potentially leading to Remote Code Execution (RCE) via gadget chains.	CWE-470, CWE-74

17 Jun 2026 03:53Current

9Critical risk

Vulners AI Score9

CVSS 26.5

CVSS 3.18 - 9.1

EPSS0.0285