CVE-2021-28938

CVE-2021-28938 describes an information leakage vulnerability in Siren Federate versions prior to 6.8.14-10.3.9, 7.6.2-20.2, 7.9.3-21.6, 7.10.2-22.2, and 7.11.2-23.0. Under specific concurrent query execution scenarios, a low-privilege user's query could execute with a high-privilege user's permissions, potentially exposing sensitive user information. This vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with low complexity and no user interaction, resulting in a low confidentiality impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this CVE.