CVE-2021-32853

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-32853
Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54 Exploit Issue Tracking
https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14 Exploit Issue Tracking
https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ Exploit Third Party Advisory
https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54 Exploit Issue Tracking
https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14 Exploit Issue Tracking
https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:erxes:erxes:*:*:*:*:*:*:*:*
History

21 Nov 2024, 06:07

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.6 		v2 : unknown
v3 : 6.1
References () https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54 - Exploit, Issue Tracking () https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54 - Exploit, Issue Tracking
References () https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14 - Exploit, Issue Tracking () https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14 - Exploit, Issue Tracking
References () https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ - Exploit, Third Party Advisory () https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ - Exploit, Third Party Advisory

02 Mar 2023, 15:56

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.6
CPE cpe:2.3:a:erxes:erxes:*:*:*:*:*:*:*:*
References (MISC) https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54 - (MISC) https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54 - Exploit, Issue Tracking
References (CONFIRM) https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ - (CONFIRM) https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ - Exploit, Third Party Advisory
References (MISC) https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14 - (MISC) https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14 - Exploit, Issue Tracking
CWE CWE-79

21 Feb 2023, 14:50

Type Values Removed Values Added
New CVE
Information

Published : 2023-02-20 23:15

Updated : 2024-11-21 06:07

NVD link : CVE-2021-32853

Mitre link : CVE-2021-32853

CVE.ORG link : CVE-2021-32853

JSON object : View

Products Affected

erxes

  • erxes
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')