PT-2021-19875 · Unknown · Pressbooks

Arzola · Published 2021-01-22 · Updated 2021-03-29 · CVE-2021-3271

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PressBooks version 5.17.3

Description The issue is related to a cross-site scripting (XSS) flaw, specifically a stored XSS. This can be submitted via the Book Info's Long Description Body. Any actions to open or preview the books page will trigger the stored XSS.

Recommendations For PressBooks version 5.17.3, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Book Info's Long Description Body to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-3271

GHSA-9652-78HP-W58C

Affected Products

Pressbooks

References · 10

• 🔥 https://github.com/pressbooks/pressbooks/pull/2072 · Exploit
• 🔥 https://gosecure.net/blog/2021/02/16/cve-2021-3271-pressbooks-stored-cross-site-scripting-proof-of-concept · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-3271 · Security Note
• https://osv.dev/vulnerability/GHSA-9652-78hp-w58c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3271 · Vendor Advisory
• https://github.com/pressbooks/pressbooks · Note
• https://github.com/pressbooks/pressbooks/commit/941a8c5eaeacea5eb211b54ee55bc0348139cbd8 · Note
• https://t.me/cvenotify/10430 · Telegram Post
• https://t.me/cybersecuritytechnologies/2732 · Telegram Post
• https://t.me/cibsecurity/23834 · Telegram Post