PT-2021-16499 · Ftapi · Ftapi

Published 2021-03-19 · Updated 2021-03-22 · CVE-2021-25278

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: FTAPI versions 4.0 through 4.10

Description: The issue allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor.

Recommendations: For FTAPI versions 4.0 through 4.10, consider disabling the Background Image upload feature in the Submit Box Template Editor until a patch is available. Restrict access to the Submit Box Template Editor to minimize the risk of exploitation. Avoid using SVG documents in the Background Image upload feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25278

Affected Products

Ftapi

References · 6

• 🔥 https://github.com/rauschecker/CVEs/tree/main/CVE-2021-25278 · Exploit
• https://ftapi.com/release-notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25278 · Security Note
• https://t.me/cvenotify/11614 · Telegram Post
• https://t.me/cibsecurity/25184 · Telegram Post