CVE-2021-4260

Estado: ModificadaMedia (6.1)—

Gravedad6.1Media · CVSS 3.1

Probabilidad de explotación0.41 %mayor que el 34 % de las CVE

Explotación activaNono figura en el catálogo de CISA

Exploit públicoNo conocidosin código público localizado

Se encontró una vulnerabilidad en oils-js. Ha sido declarada crítica. Esta vulnerabilidad afecta a código desconocido del archivo core/Web.js. La manipulación conduce a open redirect. El ataque se puede iniciar de forma remota. El nombre del parche es fad8fbae824a7d367dacb90d56cb02c5cb999d42. Se recomienda aplicar un parche para solucionar este problema. El identificador de esta vulnerabilidad es VDB-216268.

CVSS

Puntuación base: 6.1
Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.41 %
Percentil entre todas las CVEs puntuadas: 34
Fecha de la puntuación: 21/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Oils-js Project — Oils-js

CWE

CWE-601

Referencias

Mostrar las 4 referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2021-4260",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-4260",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-14T17:01:04.553527Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "vendor": "unspecified",
          "product": "oils-js",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-12-19T14:15:10.600",
  "references": [
    {
      "url": "https://github.com/mannyvergel/oils-js/commit/fad8fbae824a7d367dacb90d56cb02c5cb999d42",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?id.216268",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/mannyvergel/oils-js/commit/fad8fbae824a7d367dacb90d56cb02c5cb999d42",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vuldb.com/?id.216268",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in oils-js. It has been declared as critical. This vulnerability affects unknown code of the file core/Web.js. The manipulation leads to open redirect. The attack can be initiated remotely. The name of the patch is fad8fbae824a7d367dacb90d56cb02c5cb999d42. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216268."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en oils-js. Ha sido declarada crítica. Esta vulnerabilidad afecta a código desconocido del archivo core/Web.js. La manipulación conduce a open redirect. El ataque se puede iniciar de forma remota. El nombre del parche es fad8fbae824a7d367dacb90d56cb02c5cb999d42. Se recomienda aplicar un parche para solucionar este problema. El identificador de esta vulnerabilidad es VDB-216268."
    }
  ],
  "lastModified": "2026-06-17T04:19:22.397",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oils-js_project:oils-js:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A7CBDBB-A6C7-43EE-B94D-CCF911DAC8C1",
              "versionEndExcluding": "2021-03-23"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@vuldb.com"
}