VULNERABILITY INTELLIGENCE

CVE-2021-28113

CVSS score6.7 MEDIUM

EPSS probability22.81%

CISA KEVNot currently listed

Published2021-04-02

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Description

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account.

Weakness classification

nvd@nist.gov: CWE-78

Primary references

cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
cve@mitre.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory