PT-2021-21638 · Atlassian · Confluence

Ulrich Braun · Published 2021-09-15 · Updated 2023-01-24 · CVE-2021-37412

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TechRadar app version 1.1 for Confluence Server

Description The issue allows for XSS via the Title field of a Radar. This means an attacker could inject malicious scripts into the Title field, potentially leading to the execution of unauthorized code on the user's browser.

Recommendations For TechRadar app version 1.1, consider disabling the Title field of a Radar until a patch is available to prevent potential XSS attacks. Restrict access to the Radar feature to minimize the risk of exploitation. Avoid using the Title field in the affected Radar feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-37412

Affected Products

Confluence

References · 6

• https://osv.dev/vulnerability/CVE-2021-37412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37412 · Security Note
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-040.txt · Note
• https://t.me/cibsecurity/28925 · Telegram Post
• https://t.me/cvenotify/35160 · Telegram Post
• https://t.me/cvenotify/21363 · Telegram Post