TI-2021-17962 Aliases CVE-2021-41123

Exposure of Sensitive Information to an Unauthorized Actor in WB.UI.Headquarters.dll

LOW 26CWE-200Published 2021-10-04 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments. Starting from version 21.09.1 the endpoint is turned off by default.

Why it matters now

EPSS 0.00881 59th percentileScored 2026-11-07

Fix Fixed surveysolutions (surveysolutions): 21.09.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
surveysolutions	surveysolutions	before 21.09.1	21.09.1	Patch available	CNA

surveysolutions Vendorsurveysolutions Affected before 21.09.1 Fixed in 21.09.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mysurvey:survey_solutions::::::::	before 21.09.1	Vulnerable	Mysurvey

cpe:2.3:a:mysurvey:survey_solutions:*:*:*:*:*:*:*:* Versions before 21.09.1 Vulnerable ·Mysurvey

Remediation

Fix · CNA surveysolutions (surveysolutions) Fixed in 21.09.1

Timeline

2026-10-02 Threatist record created from CVE-2021-41123

References

Patch 1

https://github.com/surveysolutions/surveysolutions/commit/99e7e8345cb98f2eda08e37976e3d3aeb49971c9

Advisory 1

https://github.com/surveysolutions/surveysolutions/security/advisories/GHSA-6c7j-7jf3-9p3j

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences