PT-2022-11663 · Unknown · Simplerisk

Published 2022-12-21 · Updated 2022-12-27 · CVE-2021-4269

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SimpleRisk versions prior to 20220306-001

Description A vulnerability has been found in SimpleRisk, classified as problematic. It affects the function checkAndSetValidation of the file simplerisk/js/common.js. The manipulation of the argument title leads to cross-site scripting. The attack can be initiated remotely.

Recommendations For versions prior to 20220306-001, upgrade to version 20220306-001 to address this issue. As a temporary workaround, consider disabling the checkAndSetValidation function until the patch is applied. Restrict access to the simplerisk/js/common.js file to minimize the risk of exploitation. Avoid using the title argument in the affected function until the issue is resolved.

Fix

XSS

Improper Neutralization

Weakness Enumeration

CWE-79

CWE-707

Related Identifiers

CVE-2021-4269

Affected Products

Simplerisk

References · 6

• https://github.com/simplerisk/code/commit/591405b4ed160fbefc1dca1e55c5745079a7bb48 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-4269 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4269 · Vendor Advisory
• https://github.com/simplerisk/code/releases/tag/20220306-001 · Note
• https://t.me/cvenotify/40372 · Telegram Post
• https://vuldb.com/?id.216472 · Note