PT-2021-22801 · Squaredup · Squaredup For Scom

Published 2021-12-07 · Updated 2021-12-07 · CVE-2021-40092

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SquaredUp for SCOM version 5.2.1.6654

Description A cross-site scripting (XSS) issue in the Image Tile component allows remote attackers to inject arbitrary web script or HTML via an SVG file. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations For SquaredUp for SCOM version 5.2.1.6654, consider disabling the Image Tile feature until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to SVG files to minimize the risk of arbitrary web script or HTML injection.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-40092

Affected Products

Squaredup For Scom

References · 5

• https://support.squaredup.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40092 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40092 · Vendor Advisory
• https://support.squaredup.com/hc/en-us/articles/4410635417233-CVE-2021-40092-Stored-cross-site-scripting-Image-tile- · Vendor Advisory
• https://t.me/cibsecurity/33448 · Telegram Post