Medium severity · published Apr 2, 2021
CVE-2021-28113
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access…
6.7
CVSS
22.8%
EPSS
No
On KEV
Description
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)22.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Access Gateway · Okta
through 2020.8.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-28113
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-28113
Exploit
http://packetstormsecurity.com/files/163428/Okta-Access-Gateway-2020.5.5-Authenticated-Remote-Root.html
Vendor Advisory
https://www.okta.com/security-advisories/cve-2021-28113
More from Access Gateway
9.9
CVE-2026-78623
Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
7.2
CVE-2026-78550
Improper Input Handling in Okta Access Gateway Management Console Exception Handler
7.2
CVE-2026-78545
Improper Input Sanitization in Okta Access Gateway Application Label Configuration
6.7
CVE-2026-78630
Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing
6.7
CVE-2026-78625
Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration