CVE-2021-29995

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-09 · updated 2026-06-17
Weakness: CWE-352

Description

A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the logged-in user (including script execution). The issue is resolved in CloverDX 5.10, CloverDX 5.9.1, CloverDX 5.8.2, and CloverDX 5.7.1.

Affected products

Cloverdx: before 5.7.1; from 5.8.0 before 5.8.2; from 5.9.0 before 5.9.1 — fixed in 5.7.1, 5.8.2, 5.9.1

How to fix

Upgrade to a fixed version: Cloverdx 5.7.1, 5.8.2, 5.9.1. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/163697/CloverDX-5.9.0-Code-Execution-Cross-Site-Request-Forgery.html
https://support.cloverdx.com/releases/
https://support1.cloverdx.com/hc/en-us/articles/360021006520
http://packetstormsecurity.com/files/163697/CloverDX-5.9.0-Code-Execution-Cross-Site-Request-Forgery.html
https://support.cloverdx.com/releases/
https://support1.cloverdx.com/hc/en-us/articles/360021006520

Get alerted when CVE-2021-29995 or the next vulnerability affects your stack