CVE-2021-3749

highPriorität · verfolgen · 43EPSS 0.085 · 95. PerzentilExploit · PoCDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

8.52% (95th) EPSS

CVSS 7.8 · high

Is it mine?

28 products

Prüfe deine Angriffsfläche

Who says so?

8 sources

cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · bewertet 2026-10-22

axios is vulnerable to Inefficient Regular Expression Complexity

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenrhmtc/openshift-migration-ui-rhel8@sha256:19b8e2f0872faa1d1643d28aa3b893debfe22b102d049c02f335a622c29e3506_amd64 as a component of 8Base-RHMTC-1.6redhat_csaf
For details on how to install and use MTC, refer to: https://docs.openshift.com/container-platform/4.8/migration_toolkit_for_containers/installing-mtc.html
https://access.redhat.com/errata/RHSA-2021:3694
BehobenSINEC INSsiemens_psirt
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/
BehobenSINEC INScisa_csaf_ot
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/
BehobenPowerSYSTEM Centercisa_csaf_ot
For CVE-2023-45857 and CVE-2021-3749, users can disable PowerSYSTEM Center Client Access Server user's ability to access the browser's F12 Developer Tools to limit user ability to see HTTP headers and corresponding XSRF-TOKEN, and to manipulate requests to the PowerSYSTEM Center website.
MitigationPowerSYSTEM Centercisa_csaf_ot
For all vulnerabilities, users can disable usage of previous UI extensions.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.07.8highAV:N/AC:L/Au:N/C:N/I:N/A:Cprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · security@huntr.devAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Red Hat Product Security US

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1333USCWE-1333USCWE-1333USCWE-400USCWE-400USCWE-400USCWE-400USCWE-400US

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

T-Guerrero/axios-redosAxios Redos (CVE-2021-3749) proof of conceptPoC · poc_in_github

betroffene Produkte (28)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Gentoo Linuxalle Versionencert_bundDEcpe:/o:gentoo:linux:-
Oracle Linuxalle Versionencert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat OpenShift Container Platform 4alle Versionencert_bundDEcpe:/a:redhat:openshift:container_platform_4
Subnet Solutions Inc. PowerSYSTEM Center: <=PSC_2020_v5.21.xalle Versionencisa_csaf_otUS
SUBNET Solutions Inc. PowerSYSTEM Center≤ PSC_2020_v5.21.xcisa_csaf_otUS
axios axios/axios≤ unspecified ≤0.21.1enisa_euvdEU
axios axios≤ 0.21.1nvdUScpe:2.3:a:axios:axios:*:*:*:*:*:*:*:*
oracle goldengate21.1 → 21.7.0.0.0nvdUScpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*
siemens sinec ins< 1.0nvdUScpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
siemens sinec ins= 1.0nvdUScpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
npm axios< 0.21.2osvUSpkg:npm/axios
rhmtc/openshift-migration-controller-rhel8@sha256:5dacb0bb125600adb6fecdc9ac583f38877960ae207cb21e925a1df4d36c9973_amd64 as a component of 8Base-RHMTC-1.6alle Versionennot affectedredhat_csafUS
rhmtc/openshift-migration-log-reader-rhel8@sha256:efca0066bcee905c93b907d30f5a5dac779b5fdab573eba2a6af738c275658ff_amd64 as a component of 8Base-RHMTC-1.6alle Versionennot affectedredhat_csafUS
rhmtc/openshift-migration-must-gather-rhel8@sha256:4ecda5f0f4ab61eb28d2b513cf373a18d7965acf2c3f81845fa6b9ace90cc1d0_amd64 as a component of 8Base-RHMTC-1.6alle Versionennot affectedredhat_csafUS
rhmtc/openshift-migration-operator-bundle@sha256:f3dfe6ccf078244debab1ae4571b20b7ecd884cd8d382a6dc10f4a479dce2c34_amd64 as a component of 8Base-RHMTC-1.6alle Versionennot affectedredhat_csafUS
rhmtc/openshift-migration-registry-rhel8@sha256:4603fc328b26a8dc454e1cb690f9d1b6534d2e51a806fc474158447fbe8fe6eb_amd64 as a component of 8Base-RHMTC-1.6alle Versionennot affectedredhat_csafUS
rhmtc/openshift-migration-rhel8-operator@sha256:5b1911b8e44a717866d7249abd966e487c6925e5eb77eaf507922866928badb6_amd64 as a component of 8Base-RHMTC-1.6alle Versionennot affectedredhat_csafUS
rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:3678c6f67225f0f37c022bc2604a6a5d78f15b7b57ba9073d06fa3466a3a0526_amd64 as a component of 8Base-RHMTC-1.6alle Versionennot affectedredhat_csafUS

20 von 28 angezeigt

Advisories (6)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2021:3694Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.6.0 security & bugfix update2021-09-29csaf · redhat_csafUS
The Migration Toolkit for Containers (MTC) 1.6.0 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
SSA-637483SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP22022-09-13csaf · siemens_psirtDE
Multiple vulnerabilities affecting various third-party components of SINEC INS before V1.0 SP2 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for the SINEC INS and recommends to update to the latest version.
WID-SEC-W-2022-0970Red Hat OpenShift: Mehrere SchwachstellenDeutsch2022-04-07csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu verursachen und Sicherheitsmaßnahmen zu umgehen.
GHSA-cph5-m8f7-6c5xaxios Inefficient Regular Expression Complexity vulnerability2021-09-01ghsa · osvUS
axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.
ICSA-22-258-05Siemens SINEC INS2022-09-13icsa · cisa_csaf_otUS
Multiple vulnerabilities affecting various third-party components of SINEC INS before V1.0 SP2 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for the SINEC INS and recommends to update to the latest version.
ICSA-24-277-02Subnet Solutions Inc. PowerSYSTEM Center2024-10-01icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in an attacker bypassing a proxy, creating a denial-of-service condition, or viewing sensitive information.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund cisa_csaf_ot nvd osv redhat_csaf siemens_psirt NVD CVE.org MITRE

veröffentlicht 2021-08-31geändert 2026-06-17

Referenzen (58)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan