PT-2022-11702 · Insta Hms · Insta Hms

Published 2022-01-06 · Updated 2022-01-11 · CVE-2021-42841

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Insta HMS versions prior to 12.4.10

Description The issue arises from improper validation of user-supplied input by multiple scripts, leading to a potential XSS attack. A remote attacker could exploit this via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site. This could allow the attacker to steal the victim's cookie-based authentication credentials.

Recommendations For versions prior to 12.4.10, update to version 12.4.10 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable scripts to minimize the risk of exploitation. Avoid using crafted URLs that could trigger the execution of malicious scripts in the victim's Web browser.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-42841

Affected Products

Insta Hms

References · 5

• https://osv.dev/vulnerability/CVE-2021-42841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42841 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/210416 · Note
• https://t.me/cibsecurity/35084 · Telegram Post
• https://t.me/cvenotify/25073 · Telegram Post