What’s Vulnerable › Vulnerabilities

CVE-2021-42073

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-08 · updated 2026-06-17
• Weakness: CWE-384

Description

An issue was discovered in Barrier before 2.4.0. An attacker can enter an active session state with the barriers component (aka the server-side implementation of Barrier) simply by supplying a client label that identifies a valid client configuration. This label is "Unnamed" by default but could instead be guessed from hostnames or other publicly available information. In the active session state, an attacker can capture input device events from the server, and also modify the clipboard content on the server.

Affected products

• Barrier Project Barrier: before 2.4.0 — fixed in 2.4.0

How to fix

Upgrade to a fixed version: Barrier Project Barrier 2.4.0. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2021/11/02/4
• https://github.com/debauchee/barrier/commit/229abab99f39f11624e5651f819e7f1f8eddedcc
• https://github.com/debauchee/barrier/commit/b5adc93e2bd74cb094f91ff595c07f321a489f3e
• https://github.com/debauchee/barrier/releases/tag/v2.4.0
• http://www.openwall.com/lists/oss-security/2021/11/02/4
• https://github.com/debauchee/barrier/commit/229abab99f39f11624e5651f819e7f1f8eddedcc
• https://github.com/debauchee/barrier/commit/b5adc93e2bd74cb094f91ff595c07f321a489f3e
• https://github.com/debauchee/barrier/releases/tag/v2.4.0

Get alerted when CVE-2021-42073 or the next vulnerability affects your stack