PT-2022-10034 · Unknown · Review Board

Matt S · Published 2022-05-11 · Updated 2024-01-31 · CVE-2021-31330

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Review Board versions 3.0.20 and earlier Review Board versions 4.0 RC1 and earlier

Description A Cross-Site Scripting (XSS) issue exists, allowing an authenticated attacker to inject malicious Javascript code when using Markdown editing within the application, which remains persistent.

Recommendations For Review Board versions 3.0.20 and earlier, update to a version later than 3.0.20 to resolve the issue. For Review Board versions 4.0 RC1 and earlier, update to a version later than 4.0 RC1 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-REVIEWBOARD-2021-31330

CVE-2021-31330

Affected Products

Review Board

References · 7

• 🔥 https://mattschmidt.net/2021/04/14/review-board-xss-discovered · Exploit
• https://reviewboard.org/docs/releasenotes/reviewboard/4.0-rc-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31330 · Security Note
• https://osv.dev/vulnerability/BIT-reviewboard-2021-31330 · Vendor Advisory
• https://reviewboard.org/news/2021/04/14/review-board-3-0-21-and-4-0-rc-2-security-bug-fixes-and-docker · Vendor Advisory
• https://reviewboard.org/docs/releasenotes/reviewboard/3.0.21 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31330 · Vendor Advisory