PT-2021-23950 · Admidio · Admidio

P0Cas · Published 2021-12-07 · Updated 2021-12-09 · CVE-2021-43810

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Admidio versions prior to 4.0.12

Description: A cross-site scripting vulnerability is present in Admidio. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable of executing malicious scripts.

Recommendations: For versions prior to 4.0.12, update to version 4.0.12 to resolve the issue. As a temporary workaround, consider restricting access to the redirect.php file or validating the url parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43810

GHSA-3QGF-QGC3-42HH

Affected Products

Admidio

References · 8

• https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21 · Patch
• https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b · Patch
• https://github.com/Admidio/admidio/releases/tag/v4.0.12 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-43810 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43810 · Vendor Advisory
• https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh · Note
• https://t.me/cvenotify/24370 · Telegram Post
• https://t.me/cibsecurity/33541 · Telegram Post