Skip to content
Appaloosa Scout
Language selector
fr en

Vulnerability · NVD

CVE-2021-23336

CVE-2021-23336, rated medium by the vendor: 3 tracked apps concerned, all fixed or indeterminable on their current version.

Severity (CVSS)
5.9

Base CVSS ; severity is a vendor rating (different scale)

Exploitation
40.7 %

EPSS, predicted over 30 days

Tracked apps
3
Still exposed
0
Vendor bulletin scale : NVD CVSS pending

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Attack vector : Network No privileges required
Show raw CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
EPSS 40.74% moderate exploit risk percentile 98.6%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

  • Python 3.12 Windows winget:Python.Python.3.12
    Affected <3.6.13 Fixed in 3.6.13 Latest tracked 3.12.10 patched
  • Python 3.13 Windows winget:Python.Python.3.13
    Affected <3.6.13 Fixed in 3.6.13 Latest tracked 3.13.15 patched
  • Python 3.14 Windows winget:Python.Python.3.14
    Affected <3.6.13 Fixed in 3.6.13 Latest tracked 3.14.7 patched

NVD references 12 distinct products for this CVE : only those tracked by Scout (mobile and desktop catalog apps) are listed above. Libraries, servers and out-of-scope products do not appear here. Full list on NVD ↗

Vulnerable CPE configurations (4)
Vendor Product Versions
python python
All platforms (wildcard)
 <3.6.13
python python
All platforms (wildcard)
 ≥3.7.0 <3.7.10
python python
All platforms (wildcard)
 ≥3.8.0 <3.8.8
python python
All platforms (wildcard)
 ≥3.9.0 <3.9.2
View on NVD ↗ Advisory · www.openwall.com Advisory · github.com Advisory · www.oracle.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM