PT-2021-24197 · Gnome+3 · Gnome Web+3

Published 2021-12-16 · Updated 2024-06-15 · CVE-2021-45085

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: GNOME Web (aka Epiphany) versions prior to 40.4 GNOME Web (aka Epiphany) versions 41.x prior to 41.1

Description: The issue occurs when a user visits an XSS payload page often enough to place that page on the Most Visited list, allowing XSS to happen via an about: page, as demonstrated by ephy-about:overview.

Recommendations: For versions prior to 40.4, update to version 40.4 or later. For versions 41.x prior to 41.1, update to version 41.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-3546

ALT-PU-2021-3624

CVE-2021-45085

DLA-3074-1

DSA-5042-1

MGASA-2022-0053

OESA-2022-1627

OPENSUSE-SU-2024:11690-1

USN-5561-1

Affected Products

Alt Linux

Gnome Web

Linuxmint

Ubuntu

References · 32

• 🔥 https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:11690-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45086 · Security Note
• https://ubuntu.com/security/CVE-2021-45085 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45087 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29536 · Security Note
• https://ubuntu.com/security/CVE-2021-45087 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-45085 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-45085 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1627 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45085 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-45086 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5561-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0053 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/674192 · Security Note