CVE-2021-1626 Code injection in Mulesoft
Attackers can execute arbitrary code on MuleSoft runtime environments, affecting both cloud and on-premise deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-1626?
CVE-2021-1626 is a critical code injection vulnerability in Mulesoft, published on 26 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Versions affected: Mule 4.1.x and 4.2.x runtime released before February 2, 2021.
Which versions are affected by CVE-2021-1626?
It affects 1 product.
Products include Salesforce Mule.
How do I fix CVE-2021-1626?
No fix has been published for CVE-2021-1626 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-1626 being exploited?
There is no known exploitation of CVE-2021-1626 in the wild and no public exploit code.
Other vulnerabilities in Mulesoft
Sources
Also known as GHSA-mjff-hx99-hm9w.