CVE-2021-42856: aternity steelcentral appinternals dynamic sampling agent Improper Input Validation
Vulnerability summary
CVE-2021-42856 is a medium (CVSS 6.1) Improper Input Validation vulnerability in aternity steelcentral appinternals dynamic sampling agent. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48.1% of scored vulnerabilities.
Timeline
- 09-03-2022PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger a XSS vulnerability.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA4.7MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.60% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Aternity1 product
- steelcentral appinternals dynamic sampling agent≥ 10.0, < 11.0 | ≥ 12.13.0, < 12.13.0 | ≥ 11.8.8, < 11.8.8
Riverbed1 product
- steelcentral_appinternals_dynamic_sampling_agent≥ 11.0.0, < 11.8.8 | ≥ 12.0.0, < 12.13.0 | 10.0.0
2 vendors · 2 products