Description

Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.

Remediation

References

CVE-2021-28116

Related Vulnerabilities

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5264)

GibbonEdu Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2023-34598)

Oracle HTTP Server CVE-2013-5704 Vulnerability (CVE-2013-5704)

WordPress Plugin FV Flowplayer Video Player Cross-Site Scripting (7.4.37.727)

Squid Other Vulnerability (CVE-2011-3205)

Severity

Medium

Classification

CVE-2021-28116 CWE-125 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities