PT-2023-12184 · Countly · Countly

Asger F + 1 · Published 2023-02-20 · Updated 2023-03-06 · CVE-2021-32852

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Countly versions prior to 21.11

Description The issue allows for cross-site scripting. To exploit this, the victim must follow a malicious link or be redirected from a malicious website. The attacker needs to have an account or be able to create one.

Recommendations For versions prior to 21.11, update to version 21.11 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-32852

Affected Products

Countly

References · 9

• 🔥 https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/views/reset.html#L95 · Exploit
• 🔥 https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/app.js#L1112 · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2021-104-countly-server · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-32852 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32852 · Vendor Advisory
• https://github.com/Countly/countly-server/releases/tag/v21.11 · Note
• https://t.me/cvenotify/45565 · Telegram Post
• https://t.me/cibsecurity/58545 · Telegram Post
• https://t.me/cvenotify/44688 · Telegram Post