PT-2021-19382 · Unknown · Cryptshare Server

Blasty · Published 2021-03-15 · Updated 2021-12-03 · CVE-2021-3150

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cryptshare Server versions prior to 4.8.1

Description A cross-site scripting (XSS) issue exists on the Delete Personal Data page, allowing an attacker to inject arbitrary web script or HTML via the user name. This enables the attacker to potentially execute malicious code on the victim's browser. The issue is fixed in version 4.8.1.

Recommendations For Cryptshare Server versions prior to 4.8.1, update to version 4.8.1 to resolve the issue. As a temporary workaround, consider restricting access to the Delete Personal Data page until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-3150

Affected Products

Cryptshare Server

References · 6

• https://osv.dev/vulnerability/CVE-2021-3150 · Vendor Advisory
• https://wiki.cryptshare.com/display/CSM/Update+from+v4.7.1+to+v4.8.1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3150 · Security Note
• https://t.me/cvenotify/11367 · Telegram Post
• https://kc.mcafee.com/corporate/index?page=content&id=SB10356 · Note
• https://t.me/cvenotify/13252 · Telegram Post