PT-2021-24308 · Netgen · Netgen Tags Bundle

Christoph Rottermanner · Published 2021-12-27 · Updated 2022-01-07 · CVE-2021-45895

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Netgen Tags Bundle versions 3.4.x through 3.4.10 Netgen Tags Bundle versions 4.0.x through 4.0.14

Description: The issue allows for XSS in the Tags Admin interface.

Recommendations: For Netgen Tags Bundle versions 3.4.x through 3.4.10, update to version 3.4.11 or later. For Netgen Tags Bundle versions 4.0.x through 4.0.14, update to version 4.0.15 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-45895

GHSA-XVVV-WJ7J-R9JM

Affected Products

Netgen Tags Bundle

References · 6

• https://osv.dev/vulnerability/GHSA-xvvv-wj7j-r9jm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45895 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45895 · Vendor Advisory
• https://github.com/netgen/TagsBundle/releases/tag/3.4.11 · Note
• https://github.com/netgen/TagsBundle/releases/tag/4.0.15 · Note
• https://github.com/netgen/TagsBundle · Note