CVE-2021-21354

Public Exploit
Open redirect in pollbot

Description

Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things during the Firefox release process." In Pollbot before version 1.4.4 there is an open redirection vulnerability in the path of "https://pollbot.services.mozilla.com/". An attacker can redirect anyone to malicious sites. To Reproduce type in this URL: "https://pollbot.services.mozilla.com//evil.com/". Affected versions will redirect to that website when you inject a payload like "//evil.com/". This is fixed in version 1.4.4.

Category

7.4
CVSS
Severity: High
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.57%
Third-Party Advisory mozilla.org Third-Party Advisory owasp.org Third-Party Advisory github.com Third-Party Advisory github.com Third-Party Advisory github.com Third-Party Advisory github.com
Affected: mozilla PollBot
Published at:
Updated at:

References

Link Tags
https://github.com/mozilla/PollBot/security/advisories/GHSA-jhgx-wmq8-jc24 third party advisory exploit
https://bugzilla.mozilla.org/show_bug.cgi?id=1694684 issue tracking permissions required third party advisory
https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html third party advisory
https://github.com/mozilla/PollBot/releases/tag/v1.4.4 third party advisory
https://github.com/mozilla/PollBot/pull/333 third party advisory patch
https://github.com/mozilla/PollBot/commit/6db74a4fcbff258c7cdf51a6ff0724fc10c485e5 third party advisory patch

Frequently Asked Questions

What is the severity of CVE-2021-21354?
CVE-2021-21354 has been scored as a high severity vulnerability.
How to fix CVE-2021-21354?
To fix CVE-2021-21354, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2021-21354 being actively exploited in the wild?
It is possible that CVE-2021-21354 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2021-21354?
CVE-2021-21354 affects mozilla PollBot.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.