CVE-2021-28113 Command injection in n/a
Administrators can execute arbitrary OS commands via cookieDomain and relayDomain parameters in Okta Access Gateway.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-28113?
CVE-2021-28113 is a medium-severity command injection vulnerability in n/a, published on 2 Apr 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account.
Weakness: CWE-78
Which versions are affected by CVE-2021-28113?
It affects 1 product.
Products include Okta Access Gateway.
How do I fix CVE-2021-28113?
No fix has been published for CVE-2021-28113 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-28113 being exploited?
There is no known exploitation of CVE-2021-28113 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-78626 Improper Input Sanitization in Okta Access Gateway Protected Rules
- CVE-2026-78623 Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
- CVE-2026-78579 Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation
- CVE-2026-78625 Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration
- CVE-2026-78630 Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing
Sources
Also known as GHSA-j6w2-8ww3-qh9q.