CVE-2021-3841

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-3841
sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://huntr.com/bounties/1625506791178-Sylius/Sylius Broken Link
https://github.com/sylius/sylius/commit/3da169e0c23e752974d74223cc536c29a2a82edc Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
History

19 Nov 2024, 17:11

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
First Time Sylius
Sylius sylius
References () https://huntr.com/bounties/1625506791178-Sylius/Sylius - () https://huntr.com/bounties/1625506791178-Sylius/Sylius - Broken Link
References () https://github.com/sylius/sylius/commit/3da169e0c23e752974d74223cc536c29a2a82edc - () https://github.com/sylius/sylius/commit/3da169e0c23e752974d74223cc536c29a2a82edc - Patch
CPE cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
CWE CWE-79

15 Nov 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-15 11:15

Updated : 2024-11-19 17:11

NVD link : CVE-2021-3841

Mitre link : CVE-2021-3841

JSON object : View

Products Affected

sylius

  • sylius
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')