PT-2023-12184 · Countly · Countly

Asger F + 1 · Publicado 2023-02-20 · Atualizado 2023-03-06 · CVE-2021-32852

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Countly versions prior to 21.11

Description The issue allows for cross-site scripting. To exploit this, the victim must follow a malicious link or be redirected from a malicious website. The attacker needs to have an account or be able to create one.

Recommendations For versions prior to 21.11, update to version 21.11 to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-32852

Produtos afetados

Countly

Referências · 9

• 🔥 https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/views/reset.html#L95 · Exploit
• 🔥 https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/app.js#L1112 · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2021-104-countly-server · Exploit
• https://github.com/Countly/countly-server/releases/tag/v21.11 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-32852 · Nota de Segurança
• https://t.me/cvenotify/45565 · Publicação no Telegram
• https://t.me/cibsecurity/58545 · Publicação no Telegram
• https://t.me/cvenotify/44688 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2021-32852 · Aviso do Fabricante