PT-2022-12935 · Syncro Soft · Oxygen Xml Webhelp

Published 2022-07-13 · Updated 2022-07-20 · CVE-2021-46827

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oxygen XML WebHelp versions prior to 22.1 build 2021082006 Oxygen XML WebHelp versions 23.x prior to 23.1 build 2021090310

Description An issue in Oxygen XML WebHelp allows attackers to execute JavaScript by convincing a user to type specific text in the WebHelp output search field, due to an XSS vulnerability in search terms proposals. This affects online documentation generated using Oxygen XML WebHelp.

Recommendations For Oxygen XML WebHelp versions prior to 22.1 build 2021082006, update to version 22.1 build 2021082006 or later. For Oxygen XML WebHelp versions 23.x prior to 23.1 build 2021090310, update to version 23.1 build 2021090310 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-46827

Affected Products

Oxygen Xml Webhelp

References · 4

• https://osv.dev/vulnerability/CVE-2021-46827 · Vendor Advisory
• https://oxygenxml.com/security/advisory/SYNC-2021-072301.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46827 · Security Note
• https://t.me/cvenotify/32985 · Telegram Post