CVE-2021-34817

Опубликовано: 19 июл. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.

Ссылки

https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities
Third Party Advisory
https://etherpad.org/#download
Patch
Vendor Advisory
https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa
Exploit
Patch
Third Party Advisory
https://github.com/ether/etherpad-lite/releases/tag/1.8.14
Patch
Release Notes
Third Party Advisory
https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities
Third Party Advisory
https://etherpad.org/#download
Patch
Vendor Advisory
https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa
Exploit
Patch
Third Party Advisory
https://github.com/ether/etherpad-lite/releases/tag/1.8.14
Patch
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:etherpad:etherpad:1.8.13:*:*:*:*:*:*:*

EPSS

Процентиль: 75%

0.00854

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2021-34817

CVSS3: 6.1

debian

больше 4 лет назад

A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1 ...

GHSA-543c-wff7-pg59

github

больше 3 лет назад

A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.

BDU:2021-04770

CVSS3: 6.1

fstec

почти 5 лет назад

Уязвимость компонента Chat текстового редактора Etherpad, позволяющая нарушителю выполнить произвольный JavaScript-код или HTML-код

EPSS

Процентиль: 75%

0.00854

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79