CVE-2021-43697

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-29 · updated 2026-06-17
Weakness: CWE-79

Description

Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file Controller.class.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET{C('VAR_JSONP_HANDLER')] then there is a XSS vulnerability.

Affected products

Workerman-Thinkphp-Redis Project Workerman-Thinkphp-Redis: before 2018-03-16 — fixed in 2018-03-16

How to fix

Upgrade to a fixed version: Workerman-Thinkphp-Redis Project Workerman-Thinkphp-Redis 2018-03-16. Check the vendor advisory for mitigations.

References

https://github.com/happyliu2014/Workerman-ThinkPHP-Redis/issues/1
https://github.com/happyliu2014/Workerman-ThinkPHP-Redis/issues/1

Get alerted when CVE-2021-43697 or the next vulnerability affects your stack