CVE-2021-41123

Exposure of Sensitive Information to an Unauthorized Actor in WB.UI.Headquarters.dll

Description

Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments. Starting from version 21.09.1 the endpoint is turned off by default.

Category

5.3
CVSS
Severity: Medium
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.23%
Third-Party Advisory github.com Third-Party Advisory github.com
Affected: surveysolutions surveysolutions
Published at:
Updated at:

References

Link Tags
https://github.com/surveysolutions/surveysolutions/security/advisories/GHSA-6c7j-7jf3-9p3j third party advisory
https://github.com/surveysolutions/surveysolutions/commit/99e7e8345cb98f2eda08e37976e3d3aeb49971c9 third party advisory patch

Frequently Asked Questions

What is the severity of CVE-2021-41123?
CVE-2021-41123 has been scored as a medium severity vulnerability.
How to fix CVE-2021-41123?
To fix CVE-2021-41123, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2021-41123 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2021-41123 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2021-41123?
CVE-2021-41123 affects surveysolutions surveysolutions.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.