High severity · published Oct 4, 2021
CVE-2021-40683
In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of execution.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Enterprise Application Access · Akamai
before 2.3.1; 2.4.0 before 2.4.1; 2.5.0 before 2.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40683
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40683
Exploit
https://akamai.com/blog/news/eaa-client-escalation-of-privilege-vulnerability
Product
https://www.akamai.com/products/enterprise-application-access
More from Enterprise Application Access
9.8
CVE-2019-18847
Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1
8.0
CVE-2025-24527
An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17