PT-2021-20912 · Smashing · Smashing

Gebhardtr · Published 2021-07-06 · Updated 2022-05-24 · CVE-2021-35440

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Smashing version 1.3.4

Description: The issue allows an attacker to craft a URL for a widget that can execute JavaScript on the victim's computer, potentially stealing data available in the session or cookies, especially in environments where internal URLs are reused or cookies have permissive settings.

Recommendations: For Smashing version 1.3.4, consider disabling the execution of JavaScript code from crafted widget URLs as a temporary workaround until a patch is available. Restrict access to sensitive session data and cookies to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-35440

GHSA-254J-MMC5-QHPX

Affected Products

Smashing

References · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/smashing/CVE-2021-35440.yml · Exploit
• https://github.com/Smashing/smashing/pull/186 · Patch
• https://github.com/Smashing/smashing/pull/186#issuecomment-871727614 · Patch
• https://osv.dev/vulnerability/GHSA-254j-mmc5-qhpx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35440 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35440 · Vendor Advisory
• https://github.com/Smashing/smashing/blob/ad7325f159f89854ca4e7d94e7be9bee507b6d46/CHANGELOG.md · Note
• https://github.com/Smashing/smashing/pull/186/commits/f4648137ae77aa2a9ccd14b2e6eeaed2cfb32da3 · Note
• https://github.com/Smashing/smashing · Note
• https://t.me/cvenotify/17138 · Telegram Post
• https://t.me/cvenotify/17206 · Telegram Post
• https://t.me/cvenotify/17151 · Telegram Post