CVE-2021-31330

Опубликовано: 11 мая 2022

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent.

Ссылки

https://mattschmidt.net/2021/04/14/review-board-xss-discovered/
Exploit
Third Party Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/3.0.21/
Release Notes
Vendor Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/4.0-rc-2/
Release Notes
Vendor Advisory
https://www.reviewboard.org/news/2021/04/14/review-board-3-0-21-and-4-0-rc-2-security-bug-fixes-and-docker/
Release Notes
Vendor Advisory
https://mattschmidt.net/2021/04/14/review-board-xss-discovered/
Exploit
Third Party Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/3.0.21/
Release Notes
Vendor Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/4.0-rc-2/
Release Notes
Vendor Advisory
https://www.reviewboard.org/news/2021/04/14/review-board-3-0-21-and-4-0-rc-2-security-bug-fixes-and-docker/
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:reviewboard:review_board:3.0.20:*:*:*:*:*:*:*

cpe:2.3:a:reviewboard:review_board:4.0:beta1:*:*:*:*:*:*

cpe:2.3:a:reviewboard:review_board:4.0:beta2:*:*:*:*:*:*

cpe:2.3:a:reviewboard:review_board:4.0:rc1:*:*:*:*:*:*

EPSS

Процентиль: 69%

0.00589

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2021-31330

CVSS3: 5.4

debian

больше 3 лет назад

A Cross-Site Scripting (XSS) vulnerability exists within Review Board ...

GHSA-mhg9-m5gc-hhqw

CVSS3: 5.4

github

больше 3 лет назад

EPSS

Процентиль: 69%

0.00589

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79