PT-2021-18559 · Unknown · Hubs Cloud

Muhammad R. Maulana · Published 2021-08-02 · Updated 2021-08-11 · CVE-2021-29979

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hubs Cloud versions prior to 1.0.1/20210618012634

Description The issue allows users to download shared content, specifically HTML and JS, which could enable javascript execution in the Hub Cloud instance's primary hosting domain.

Recommendations For versions prior to 1.0.1/20210618012634, consider restricting the download of shared HTML and JS content to prevent potential javascript execution in the primary hosting domain. As a temporary workaround, consider disabling the feature that allows users to download shared content until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-29979

Affected Products

Hubs Cloud

References · 4

• https://mozilla.org/security/advisories/mfsa2021-32 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29979 · Security Note
• https://t.me/cibsecurity/26711 · Telegram Post
• https://bugzilla.mozilla.org/show_bug.cgi?id=1712495 · Note