LiveActive security incident?Get immediate response
CVE Record

CVE-2021-23495: Open Redirect

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.

MediumCVSS 5.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Karma versions before 6.3.16 did not properly validate the return_url parameter, allowing a crafted link to send a user to an unintended external site. Business impact is mainly phishing and trust abuse around developer or test infrastructure, not direct server takeover.

Executive priority

Treat as a moderate dependency hygiene issue. Prioritize remediation where development tooling is exposed beyond localhost or CI isolation, or where links from trusted internal test systems could be abused in phishing.

Technical view

CVE-2021-23495 is an open redirect in the karma package before 6.3.16. The CVSS 3.1 score is 5.4, with network access, low complexity, no privileges, and required user interaction. The public sources identify the flaw as missing validation of return_url and point to an upstream fixing commit.

Likely exposure

Exposure is most likely in projects using vulnerable npm karma or WebJars npm karma packages, especially where the Karma server is reachable by users or networks beyond a local test workflow. The bundle does not identify specific deployed products or CPEs.

Exploitation context

The source bundle does not show active exploitation, and CISA KEV is false. Exploitation would require a user to interact with a crafted URL, making this more relevant to phishing, redirect-chain abuse, and security-control bypass scenarios than automated compromise.

Researcher notes

The available evidence is narrow: package name, vulnerable range before 6.3.16, parameter name, CVSS vector, Snyk advisories, and a GitHub commit. No CWE, exploit-in-the-wild evidence, affected CPEs, or detailed product deployment context are provided.

Mitigation direction

  • Upgrade karma to 6.3.16 or later where applicable.
  • Update affected WebJars npm karma dependencies if used.
  • Restrict Karma test servers to trusted local or CI networks.
  • Check vendor and package-manager guidance for any ecosystem-specific update paths.

Validation and detection

  • Inventory package-lock, yarn.lock, pnpm-lock, and SBOM entries for karma versions.
  • Check Maven or Gradle dependencies for org.webjars.npm karma artifacts.
  • Confirm no reachable test server runs a vulnerable Karma version.
  • Review CI images and developer templates for pinned vulnerable dependencies.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-23495 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.4CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N2.82.5Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.4Medium
CVSS 3.1 vector shape for CVE-2021-23495Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/akarmaunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.