GHSA-rwh9-8xx8-4wfm

ghsaUSosv

Cross-site Scripting in OpenCRX

view advisory published 2021-09-30Licence: CC-BY-4.0

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-25959US	medium6.1	0.86% (59th)	—	2021-09-29
In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows ex…

references

External citations — patches, advisories, analysis.

https://github.com/opencrx/opencrxPACKAGE
https://github.com/opencrx/opencrx/commit/14e75f95e5f56fbe7ee897bdf5d858788072e818WEB
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25959WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan