org.apache.knox:gateway-release (>=1.0.0 <=1.1.0), org.apache.knox:gateway-test-release (>=1.0.0 <=1.1.0) +3 more potentially affected by CVE-2021-42357 via org.apache.knox:gateway-service-knoxsso (>=1.0.0 <=1.1.0)

org.apache.knox:gateway-service-knoxsso MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0 Source cves: CVE-2021-42357 Source advisory: OSV:GHSA-VV38-4XCJ-Q4RW...

CVE-2021-42357 DOM based XSS Vulnerability in Apache Knox

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

CVE-2021-42357

CVE-2021-42357 affects Apache Knox SSO prior to 1.6.1. The issue arises from improper URL parsing, allowing a crafted request parameter to redirect users to an attacker-controlled page. Practical impact described across sources is a user-facing redirect that would need exposure outside the normal...