{"id":"CVE-2021-23336","state":"PUBLISHED","title":"Web Cache Poisoning","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","publishedAt":"2021-02-15T12:15:20.788Z","updatedAt":"2026-10-14T11:34:52.993Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H/E:P/RL:U/RC:C","source":"snyk"},"assigner":"snyk","products":["n/a python/cpython"],"affected":[{"vendor":"n/a","product":"python/cpython","versions":[{"version":"0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"3.6.13","versionType":"custom"},{"version":"3.7.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"3.7.10","versionType":"custom"},{"version":"3.8.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"3.8.8","versionType":"custom"},{"version":"3.9.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"3.9.2","versionType":"custom"}]}],"references":["https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://github.com/python/cpython/pull/24297","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","http://www.openwall.com/lists/oss-security/2021/02/19/4","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://security.gentoo.org/glsa/202104-04","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://www.oracle.com/security-alerts/cpuApr2021.html","https://security.netapp.com/advisory/ntap-20210326-0004/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"weaknesses":["CWE-444"],"ingestedAt":"2026-10-29T19:48:04.982Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/23xxx/CVE-2021-23336.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-23336","state":"PUBLISHED","datePublished":"2021-02-15T12:15:20.788Z","dateUpdated":"2026-10-14T11:34:52.993Z","assignerShortName":"snyk","assignerOrgId":"bae035ff-b466-4ff4-94d0-fc9efd9e1730","dateReserved":"2021-01-08T00:00:00.000Z"},"containers":{"cna":{"title":"Web Cache Poisoning","descriptions":[{"lang":"en","value":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}],"affected":[{"vendor":"n/a","product":"python/cpython","versions":[{"version":"0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"3.6.13","versionType":"custom"},{"version":"3.7.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"3.7.10","versionType":"custom"},{"version":"3.8.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"3.8.8","versionType":"custom"},{"version":"3.9.0","status":"affected","lessThan":"unspecified","versionType":"custom"},{"version":"unspecified","status":"affected","lessThan":"3.9.2","versionType":"custom"}]}],"references":[{"url":"https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933"},{"url":"https://github.com/python/cpython/pull/24297"},{"url":"https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/"},{"url":"http://www.openwall.com/lists/oss-security/2021/02/19/4","name":"[oss-security] 20210219 Django security releases: CVE-2021-23336: Web cache poisoning via ``django.utils.http.limited_parse_qsl()``","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","name":"[debian-lts-announce] 20210219 [SECURITY] [DLA 2569-1] python-django security update","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","name":"FEDORA-2021-7547ad987f","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","name":"FEDORA-2021-f4fd9372c7","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","name":"FEDORA-2021-3352c1c802","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","name":"FEDORA-2021-7d3a9004e2","tags":["vendor-advisory"]},{"url":"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","name":"[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","name":"FEDORA-2021-907f3bacae","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","name":"FEDORA-2021-7c1bb32d13","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","name":"FEDORA-2021-b1843407ca","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","name":"FEDORA-2021-2897f5366c","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","name":"FEDORA-2021-b326fcb83f","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","name":"FEDORA-2021-1bb399a5af","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","name":"FEDORA-2021-ef83e8525a","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","name":"FEDORA-2021-b76ede8f4d","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","name":"FEDORA-2021-309bc2e727","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","name":"FEDORA-2021-5a09621ebb","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","name":"FEDORA-2021-e22bb0e548","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","name":"FEDORA-2021-e525e48886","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","name":"[debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","name":"[debian-lts-announce] 20210417 [SECURITY] [DLA 2628-1] python2.7 security update","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","name":"FEDORA-2021-b6b6093b3a","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202104-04","name":"GLSA-202104-04","tags":["vendor-advisory"]},{"url":"https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","name":"[airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2021/05/01/2","name":"[oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","name":"[announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","name":"FEDORA-2021-98720f3785","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","name":"FEDORA-2021-12df7f7382","tags":["vendor-advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"url":"https://security.netapp.com/advisory/ntap-20210326-0004/"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","name":"[debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update","tags":["mailing-list"]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H/E:P/RL:U/RC:C","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH","exploitCodeMaturity":"PROOF_OF_CONCEPT","remediationLevel":"UNAVAILABLE","reportConfidence":"CONFIRMED","baseScore":5.9,"temporalScore":5.6,"baseSeverity":"MEDIUM","temporalSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"Web Cache Poisoning"}]}],"providerMetadata":{"shortName":"snyk","orgId":"bae035ff-b466-4ff4-94d0-fc9efd9e1730","dateUpdated":"2023-09-20T21:06:13.958Z"},"datePublic":"2021-02-15T00:00:00.000Z","credits":[{"lang":"en","value":"Snyk Security Team"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","tags":["x_transferred"]},{"url":"https://github.com/python/cpython/pull/24297","tags":["x_transferred"]},{"url":"https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2021/02/19/4","name":"[oss-security] 20210219 Django security releases: CVE-2021-23336: Web cache poisoning via ``django.utils.http.limited_parse_qsl()``","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","name":"[debian-lts-announce] 20210219 [SECURITY] [DLA 2569-1] python-django security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","name":"FEDORA-2021-7547ad987f","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","name":"FEDORA-2021-f4fd9372c7","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","name":"FEDORA-2021-3352c1c802","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","name":"FEDORA-2021-7d3a9004e2","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","name":"[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar","tags":["mailing-list","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","name":"FEDORA-2021-907f3bacae","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","name":"FEDORA-2021-7c1bb32d13","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","name":"FEDORA-2021-b1843407ca","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","name":"FEDORA-2021-2897f5366c","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","name":"FEDORA-2021-b326fcb83f","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","name":"FEDORA-2021-1bb399a5af","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","name":"FEDORA-2021-ef83e8525a","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","name":"FEDORA-2021-b76ede8f4d","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","name":"FEDORA-2021-309bc2e727","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","name":"FEDORA-2021-5a09621ebb","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","name":"FEDORA-2021-e22bb0e548","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","name":"FEDORA-2021-e525e48886","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","name":"[debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","name":"[debian-lts-announce] 20210417 [SECURITY] [DLA 2628-1] python2.7 security update","tags":["mailing-list","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","name":"FEDORA-2021-b6b6093b3a","tags":["vendor-advisory","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202104-04","name":"GLSA-202104-04","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","name":"[airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL","tags":["mailing-list","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2021/05/01/2","name":"[oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL","tags":["mailing-list","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","name":"[announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL","tags":["mailing-list","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","name":"FEDORA-2021-98720f3785","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","name":"FEDORA-2021-12df7f7382","tags":["vendor-advisory","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20210326-0004/","tags":["x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","name":"[debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update","tags":["mailing-list","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T19:05:55.612Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-17T21:16:05.233145Z","id":"CVE-2021-23336","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-444","type":"CWE","lang":"en","description":"CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-17T21:16:09.153Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-14T11:34:52.993Z"},"x_adpType":"supplier"}]}}}