Server Side Request Forgery Vulnerability in MuleSoft Runtime
CVE-2021-1627

9.8CRITICAL

Key Information:

Vendor

Salesforce

Status
Mulesoft
Vendor
CVE Published:
26 March 2021

What is CVE-2021-1627?

MuleSoft has identified a Server Side Request Forgery vulnerability in specific versions of its Mule runtime component. This vulnerability may impact both CloudHub and on-premise installations, allowing attackers to send unauthorized requests from the server's context. The affected versions include Mule 3.8.x, 3.9.x, and 4.x, released prior to February 2, 2021. Organizations utilizing these versions should take immediate action to assess their environments and implement necessary security measures to safeguard against potential exploitation.

Affected Version(s)

Mulesoft Mule 3.8.x,3.9.x,4.x runtime released before February 2, 2021

References

https://help.salesforce.com/articleView?id=000357383&type...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2021-1627 : Server Side Request Forgery Vulnerability in MuleSoft Runtime