PT-2022-12176 · Unknown · Jeecg-Boot

Tsuki124 · Published 2022-03-10 · Updated 2022-03-18 · CVE-2021-44585

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jeecg-boot version 3.0

Description A Cross Site Scripting (XSS) issue exists in jeecg-boot, specifically in the /jeecg-boot/jmreport/view endpoint with a mouseover event. This issue is related to jeecg-boot being a code generator.

Recommendations For jeecg-boot version 3.0, consider disabling access to the /jeecg-boot/jmreport/view endpoint until a patch is available to prevent potential exploitation of the XSS issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-44585

GHSA-Q448-6C3M-CXMJ

Affected Products

Jeecg-Boot

References · 8

• 🔥 https://github.com/jeecgboot/jeecg-boot/issues/3223 · Exploit
• https://osv.dev/vulnerability/CVE-2021-44585 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q448-6c3m-cxmj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44585 · Security Note
• https://github.com/jeecgboot/jeecg-boot/commit/dbba190980fe44ab5377703dc1a9487806ee2a91 · Note
• https://github.com/jeecgboot/jeecg-boot · Note
• https://t.me/cvenotify/28064 · Telegram Post
• https://t.me/cibsecurity/38744 · Telegram Post