PT-2021-17736 · Unknown+1 · Electronjs+1

4Nqr34Z + 1 · Published 2021-04-26 · Updated 2021-11-01 · CVE-2021-28079

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Jamovi versions prior to 1.6.19

Description: A cross-site scripting (XSS) issue affects Jamovi, where the column-name is vulnerable in the ElectronJS Framework. An attacker can create a .omv document containing a malicious payload. When this document is opened by a victim, the payload is triggered.

Recommendations: For Jamovi versions prior to 1.6.19, update to version 1.6.19 or later to resolve the issue. As a temporary workaround, consider avoiding the use of user-provided .omv documents until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-28079

Affected Products

Electronjs

Jamovi

References · 7

• 🔥 https://github.com/theart42/cves/blob/master/CVE-2021-28079/CVE-2021-28079.md · Exploit
• 🔥 https://github.com/g33xter/CVE-2021-28079 · Exploit
• https://jamovi.org · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28079 · Security Note
• https://t.me/pentestingnews/13258 · Telegram Post
• https://t.me/cybersecuritytechnologies/4649 · Telegram Post