CVE-2021-38384

Published: Aug 10, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).

Affected (1)

Products: Serverless Offline Project: Serverless Offline

Serverless Offline Project

1 product

Serverless Offline

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Serverless Offline Project Serverless Offline	Version 8.0.0

Related CWEs

Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

References (2)

https://github.com/dherault/serverless-offline/issues/1259

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/dherault/serverless-offline/issues/1259

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.