PT-2021-17384 · X2Engine · X2Crm

Hades484 · Published 2021-04-14 · Updated 2021-04-20 · CVE-2021-27288

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions X2Engine X2CRM version 7.1

Description The issue allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the Comment field in the "/profile/activity" API endpoint. This can lead to the disclosure of sensitive data.

Recommendations For version 7.1, update the software to a version that includes a fix for this issue, or as a temporary workaround, consider restricting access to the "/profile/activity" page to minimize the risk of exploitation. Avoid using the Comment field in the affected page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27288

Affected Products

X2Crm

References · 3

• 🔥 https://github.com/X2Engine/X2CRM/issues/183 · Exploit
• https://osv.dev/vulnerability/CVE-2021-27288 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27288 · Security Note