PT-2021-17510 · Appspace · Appspace

Published 2021-02-22 · Updated 2021-02-26 · CVE-2021-27564

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Appspace version 6.2.4

Description A stored XSS issue exists, allowing an authenticated user to enter an XSS payload under the groups section of the network tab, which is then stored as the group name. This payload executes whenever another member visits that group.

Recommendations For Appspace version 6.2.4, as a temporary workaround, consider restricting access to the groups section of the network tab until a patch is available. Avoid using the groups feature in the network tab to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27564

Affected Products

Appspace

References · 3

• 🔥❌ https://github.com/viperbluff/Appspace-Ver-6.2.4-Stored-Xss · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2021-27564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27564 · Security Note