PT-2021-17675 · Unknown · Irisnext Edition

Published 2021-07-06 · Updated 2021-07-09 · CVE-2021-27930

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R

Name of the Vulnerable Software and Affected Versions: IrisNext Edition version 9.5.16

Description: The issue allows an authenticated user to inject malicious JavaScript in folder or file names within the application, potentially leading to the execution of malicious code in other users' browsers or the grabbing of their sessions. This is achieved through multiple stored cross-site scripting (XSS) vulnerabilities, where arbitrary web script or HTML can be injected via a document or folder name that is mishandled when rendering certain forms.

Recommendations: For IrisNext Edition version 9.5.16, consider restricting the ability to inject arbitrary web script or HTML via document or folder names as a temporary workaround until a patch is available. Avoid using the application's features that allow folder or file name modifications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27930

Affected Products

Irisnext Edition

References · 6

• 🔥 https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2021-27930.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-27930 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27930 · Vendor Advisory
• https://t.me/cvenotify/17127 · Telegram Post
• https://varsnext.iriscorporate.com/history.html · Note
• https://t.me/cibsecurity/25926 · Telegram Post