PT-2021-16856 · Sickrage · Sickrage

Published 2021-04-12 · Updated 2024-02-09 · CVE-2021-25926

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SiCKRAGE versions 9.3.54.dev1 to 10.0.11.dev1

Description The issue arises from improper validation of user input in the quicksearch feature, leading to Reflected Cross-Site-Scripting (XSS). This allows an attacker to steal a user's sessionID, enabling them to masquerade as the victim user and perform actions in the user's context.

Recommendations For SiCKRAGE versions 9.3.54.dev1 to 10.0.11.dev1, consider disabling the quicksearch feature until a patch is available to prevent exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25926

GHSA-X823-J7C4-VPC5

PYSEC-2021-148

Affected Products

Sickrage

References · 10

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25926, · Exploit
• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25926%2C · Exploit
• https://github.com/SiCKRAGE/SiCKRAGE/commit/9f42426727e16609ad3d1337f6637588b8ed28e4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25926 · Security Note
• https://osv.dev/vulnerability/GHSA-x823-j7c4-vpc5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25926 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-148 · Vendor Advisory
• https://github.com/SiCKRAGE/SiCKRAGE · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/sickrage/PYSEC-2021-148.yaml · Note
• https://github.com/advisories/GHSA-x823-j7c4-vpc5 · Note