Files or Directories Accessible to External Parties in SSL VPN Client - CVE-2021-47960
Published: April 14, 2026
Vulnerability identifier: #VU125951
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-47960
CWE-ID: CWE-552
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to files or directories accessible to external parties in the local HTTP service bound to the loopback interface when handling requests from a crafted web page. A remote attacker can trick the victim into interacting with a crafted web page to disclose sensitive information.
User interaction is required, and exposed files may include configuration files, certificates, and logs from the installation directory.
Affected software
SSL VPN Client
How to mitigate CVE-2021-47960
Install security update from vendor's website.
SSL VPN Client - update to 1.4.5-0684