CVE-2021-4247 - CVE House

Back to Database

Status published Medium CVE-2021-4247

OWASP NodeGoat Query Parameter research.js denial of service

4.3 CVSS

Vulnerability Description

A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The name of the patch is 4a4d1db74c63fb4ff8d366551c3af006c25ead12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216184.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-4247

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OWASP

View All →

OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range

Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header

Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header

Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header

Affected Vendor

OWASP

View all reports →

Affected Software

NodeGoat

Vulnerable Versions:

Unknown

Timeline

Official Publish: December 18th, 2022

Last Modified: April 15th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1562 Impair Defenses

Defense Evasion

T1190 Exploit Public-Facing Application

T1046 Network Service Discovery