CVE-2021-23336
MediumSummary
A vulnerability in CPython (from version 0 to 3.6.13, 3.7.0-3.7.10, 3.8.0-3.8.8, 3.9.0-3.9.2) allows Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs functions. An attacker can use a technique called 'parameter cloaking' to manipulate query parameters.
Risk Assessment
The organization is at risk of Web Cache Poisoning attacks, which can lead to serving malicious content to users, data theft, or session hijacking.
Recommendation
Immediately upgrade CPython to version 3.6.13, 3.7.10, 3.8.8, 3.9.2 or later. If upgrade is not possible, consider using alternative query parameter parsing methods.
Original NVD description (English source)
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can se