CVE-2021-34817 - Vulnerability Details - OpenCVE

A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Etherpad	Etherpad

Configuration 1 [-]

cpe:2.3:a:etherpad:etherpad:1.8.13:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities
https://etherpad.org/#download
https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa
https://github.com/ether/etherpad-lite/releases/tag/1.8.14

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-07-19T13:38:11

Updated: 2024-08-04T00:26:53.996Z

Reserved: 2021-06-17T00:00:00

Link: CVE-2021-34817

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-07-19T14:15:08.150

Modified: 2024-11-21T06:11:15.953

Link: CVE-2021-34817

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-07-19T13:38:11", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://etherpad.org/#download"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ether/etherpad-lite/releases/tag/1.8.14"}, {"tags": ["x_refsource_MISC"], "url": "https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-34817", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://etherpad.org/#download", "refsource": "MISC", "url": "https://etherpad.org/#download"}, {"name": "https://github.com/ether/etherpad-lite/releases/tag/1.8.14", "refsource": "MISC", "url": "https://github.com/ether/etherpad-lite/releases/tag/1.8.14"}, {"name": "https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities", "refsource": "MISC", "url": "https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities"}, {"name": "https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa", "refsource": "MISC", "url": "https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T00:26:53.996Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://etherpad.org/#download"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ether/etherpad-lite/releases/tag/1.8.14"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-34817", "datePublished": "2021-07-19T13:38:11", "dateReserved": "2021-06-17T00:00:00", "dateUpdated": "2024-08-04T00:26:53.996Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:etherpad:etherpad:1.8.13:*:*:*:*:*:*:*", "matchCriteriaId": "A5B28B8D-9C9D-41A7-834C-2DEBE3862A6D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad."}, {"lang": "es", "value": "Un problema de tipo Cross-Site Scripting (XSS) en el componente chat de Etherpad versi\u00f3n 1.8.13, permite a atacantes remotos inyectar JavaScript o HTML arbitrario al importar un pad dise\u00f1ado"}], "id": "CVE-2021-34817", "lastModified": "2024-11-21T06:11:15.953", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-07-19T14:15:08.150", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://etherpad.org/#download"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa"}, {"source": "cve@mitre.org", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/ether/etherpad-lite/releases/tag/1.8.14"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://blog.sonarsource.com/etherpad-code-execution-vulnerabilities"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://etherpad.org/#download"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/ether/etherpad-lite/releases/tag/1.8.14"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}