PT-2022-10330 · Deluge+2 · Deluge Web-Ui+2

Jasperla · Published 2022-06-30 · Updated 2024-06-15 · CVE-2021-3427

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Deluge Web-UI (affected versions not specified)

Description The issue arises from the improper sanitization of data from torrent files, which is interpreted directly as HTML. This allows an attacker to execute arbitrary Javascript code in the context of the user's browser session by supplying a malicious torrent file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2022-2154

CVE-2021-3427

GHSA-5C8P-QHCH-QHX6

OPENSUSE-SU-2024:12322-1

PYSEC-2022-256

Affected Products

Alt Linux

Debian

Deluge Web-Ui

References · 18

• 🔥 https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg · Exploit
• 🔥 https://dev.deluge-torrent.org/ticket/3459 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3427 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3427 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12322-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3427 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3427 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3427 · Security Note
• https://osv.dev/vulnerability/GHSA-5c8p-qhch-qhx6 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-07 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3427 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-256 · Vendor Advisory
• https://github.com/deluge-torrent/deluge · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/deluge/PYSEC-2022-256.yaml · Note