CVE-2021-38384
9.8 CRITICALServerless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to imp...
Published: 2021-08-10 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-755
Affected products
| Vendor | Product |
|---|---|
| serverless_offline_project | serverless_offline |
Description
Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-38384
- [Exploit reference]https://github.com/dherault/serverless-offline/issues/1259
- [Exploit reference]https://github.com/dherault/serverless-offline/issues/1259
Related CVEs
Same CWE
- CVE-2026-44505 — Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm (5.3 MEDIUM)
- CVE-2023-43686 — An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later) (6.2 MEDIUM)
- CVE-2026-49235 — When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes (7.5 HIGH)
- CVE-2026-49232 — Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of ...
- CVE-2026-9516 — Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (7.5 HIGH)