PT-2021-16912 · Ifme · Ifme

Published 2021-12-29 · Updated 2022-01-06 · CVE-2021-25989

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ifme versions 1.0.0 through 7.31.4

Description The issue is related to a stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group, which triggers the payload for them.

Recommendations For versions 1.0.0 through 7.31.4, consider disabling the markdown editor until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to the group leadership feature to minimize the risk of triggering the payload.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25989

Affected Products

Ifme

References · 6

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25989 · Exploit
• https://github.com/ifmeorg/ifme/commit/df4986f0721a72779403d21d36c025fe95edffad · Patch
• https://osv.dev/vulnerability/CVE-2021-25989 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25989 · Security Note
• https://t.me/cibsecurity/34722 · Telegram Post
• https://t.me/cvenotify/25067 · Telegram Post