What’s Vulnerable › Vulnerabilities

CVE-2021-28113

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 22.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-02 · updated 2026-06-17
• Weakness: CWE-78

Description

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account.

Affected products

• Okta Access Gateway: through 2020.8.4

References

• http://packetstormsecurity.com/files/163428/Okta-Access-Gateway-2020.5.5-Authenticated-Remote-Root.html
• https://www.okta.com/security-advisories/cve-2021-28113
• http://packetstormsecurity.com/files/163428/Okta-Access-Gateway-2020.5.5-Authenticated-Remote-Root.html
• https://www.okta.com/security-advisories/cve-2021-28113

Get alerted when CVE-2021-28113 or the next vulnerability affects your stack