Okta Access Gateway CVE-2021-28113
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway in version 2020.8.4 and earlier allows attackers with admin access to the Okta Access Gateway UI to execute OS commands as a privileged system account.
Affected product and versions
Okta Access Gateway version 2020.8.4 and earlier
The vulnerability is fixed in Okta Access Gateway version 2020.9.3 and newer. To remediate this vulnerability upgrade Okta Access Gateway.
|Published Date||April 2, 2021|
|Vulnerability Type||Command Injection|
Okta would like to thank Jeremy Brown for responsibly reporting this vulnerability.