CVE-2021-20066

mediumpriority · track · 22EPSS 0.014 · 72 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.39% (72nd) EPSS

CVSS 6.8 · medium

Is it mine?

26 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

EPSS · scored 2026-10-27

JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.

cvss

Technical severity, 0–10. One row per scoring source.

6.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · none–medium · 0–6.8

v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 6.4

v3.15.6mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:Lprimary · NVD / NIST USexploitability 2.2 · impact 3.4

v3.10noneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Nsecondary · OSV

v3.15.1mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1220US

affected products (26)

Products and version ranges known to be affected.

Atlassian Confluence <10.0.2all versionscert_bundDE
Atlassian Confluence <10.1.1all versionscert_bundDE
Atlassian Confluence <8.5.25all versionscert_bundDE
Atlassian Confluence <9.2.7all versionscert_bundDE
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Splunk Splunk Enterpriseall versionscert_bundDEcpe:/a:splunk:splunk:-
Splunk Splunk Enterprise <8.2.12all versionscert_bundDE
Splunk Splunk Enterprise <9.0.6all versionscert_bundDE
Splunk Splunk Enterprise <9.0.9all versionscert_bundDE
Splunk Splunk Enterprise <9.1.1all versionscert_bundDE
Splunk Splunk Enterprise <9.1.4all versionscert_bundDE
Splunk Splunk Enterprise <9.2.1all versionscert_bundDE
Atlassian Confluence< 10.0.2cert_bundDE
Atlassian Confluence< 10.1.1cert_bundDE
Atlassian Confluence< 8.5.25cert_bundDE
Atlassian Confluence< 9.2.7cert_bundDE
Splunk Splunk Enterprise< 8.2.12cert_bundDE
Splunk Splunk Enterprise< 9.0.6cert_bundDE
Splunk Splunk Enterprise< 9.0.9cert_bundDE

showing 20 of 26

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-2229Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2023-08-30csaf · cert_bundDE
Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen 'Denial of Service'-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.
GHSA-f4c9-cqv8-9v98Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom2022-05-24ghsa · osvUS
# Withdrawn Advisory This advisory has been withdrawn because the user must configure jsdom to allow access to local files. # Original Description JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

published 2021-02-16modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951 cnnvd
https://nvd.nist.gov/vuln/detail/CVE-2021-20066 cnnvd
https://www.tenable.com/security/research/tra-2021-05 cnnvd
https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951 enisa_euvd
https://www.tenable.com/security/research/tra-2021-05 enisa_euvd
https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951ExploitIssue TrackingThird Party Advisorynvd
https://www.tenable.com/security/research/tra-2021-05ExploitThird Party Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan