PT-2021-21960 · Onenav · Onenav

Alex123-2Star · Published 2021-08-05 · Updated 2022-09-28 · CVE-2021-38138

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: OneNav beta version 0.9.12

Description: The issue allows for XSS via the Add Link feature. The vendor has stated that there is intentionally no XSS protection at present, as the attack risk is largely limited to a compromised account. However, XSS protection is planned for a future release.

Recommendations: For OneNav beta version 0.9.12, consider disabling the Add Link feature until XSS protection is implemented in a future release.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-38138

Affected Products

Onenav

References · 7

• 🔥 https://github.com/helloxz/onenav/issues/26 · Exploit
• 🔥 http://packetstormsecurity.com/files/163753/OneNav-Beta-0.9.12-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-38138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38138 · Security Note
• https://github.com/helloxz/onenav/releases · Note
• https://t.me/cibsecurity/26887 · Telegram Post
• https://t.me/cvenotify/18709 · Telegram Post