PT-2022-11826 · Unknown · Buddyboss Platform

Published 2022-01-26 · Updated 2022-02-02 · CVE-2021-43334

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BuddyBoss Platform versions 1.8.0 and earlier

Description The issue allows XSS via the Group Name or Group Description field. This can be exploited to execute malicious scripts.

Recommendations For BuddyBoss Platform versions 1.8.0 and earlier, update to a version later than 1.8.0 to resolve the issue. As a temporary workaround, consider restricting user input in the Group Name and Group Description fields to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43334

Affected Products

Buddyboss Platform

References · 7

• 🔥 https://cygenta.co.uk/post/buddyboss · Exploit
• https://buddyboss.com/resources/buddyboss-platform-releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43334 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43334 · Vendor Advisory
• https://t.me/cvenotify/25867 · Telegram Post
• https://t.me/cibsecurity/36317 · Telegram Post
• https://t.me/cvenotify/26176 · Telegram Post