PT-2021-17418 · Monica · Monica

Alromh87 · Published 2021-02-22 · Updated 2021-02-23 · CVE-2021-27371

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Monica version 2.19.1

Description The issue allows stored XSS via the Description field on the Contact page.

Recommendations For Monica version 2.19.1, update to a version that fixes this issue to prevent stored XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27371

Affected Products

Monica

References · 5

• 🔥 https://github.com/monicahq/monica/issues/4888 · Exploit
• 🔥 https://github.com/monicahq/monica/pull/4543 · Exploit
• https://osv.dev/vulnerability/CVE-2021-27371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27371 · Security Note
• https://t.me/cibsecurity/23930 · Telegram Post