CVE-2021-29357: Outsystems Lifetime Management Console

High severity, CVSS 8.6. EPSS: 1% chance of exploitation in the next 30 days.

The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbound HTTP requests.

Affected products

• Outsystems Lifetime Management Console: from 11, before 11.7.0 (fixed in 11.7.0)
• Outsystems Outsystems: from 10, before 10.0.1104.0 (fixed in 10.0.1104.0)
• Outsystems Platform Server: from 11, before 11.9.0 (fixed in 11.9.0)

Published 2021-04-12. Last modified 2026-06-17.