TI-2021-18773 Aliases CVE-2021-42357 GHSA-vv38-4xcj-q4rw

DOM based XSS Vulnerability in Apache Knox

LOW 32CWE-79Published 2022-01-17 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.

Why it matters now

EPSS 0.02579 85th percentileScored 2026-11-07

Fix Fixed Apache Knox (Apache Software Foundation): 1.6.1org.apache.knox:gateway-service-knoxsso (Maven): 1.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Knox	Apache Knox 1.x to before 1.6.1; 0.12.0 and later	1.6.1	Patch available	CNA
—	org.apache.knox:gateway-service-knoxsso (Maven)	before 1.6.1	1.6.1	Patch available	GHSA-vv38-4xcj-q4rw

Apache Knox VendorApache Affected Apache Knox 1.x to before 1.6.1; 0.12.0 and later Fixed in 1.6.1 Patch available CNA
org.apache.knox:gateway-service-knoxsso (Maven) Vendor— Affected before 1.6.1 Fixed in 1.6.1 Patch available GHSA-vv38-4xcj-q4rw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:knox::::::::	before 1.6.1	Vulnerable	Apache

cpe:2.3:a:apache:knox:*:*:*:*:*:*:*:* Versions before 1.6.1 Vulnerable ·Apache

Remediation

Fix · CNA Apache Knox (Apache Software Foundation) Fixed in 1.6.1
Fix · GHSA-vv38-4xcj-q4rw org.apache.knox:gateway-service-knoxsso (Maven) Fixed in 1.6.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-42357
2026-10-03 Alias added: GHSA-vv38-4xcj-q4rw

References

Advisory 3

TI-2017-03646 Origin validation error in Apache Knox CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences