PT-2023-12407 · Shannah · Xataface

Shannah · Published 2023-01-05 · Updated 2024-05-17 · CVE-2021-4303

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions shannah Xataface versions up to 2.x

Description A problematic issue has been found in the function testftp of the file install/install form.js.php of the component Installer, leading to cross site scripting. The attack may be launched remotely, with a rather high complexity and difficult exploitation. Upgrading to version 3.0.0 can address this issue.

Recommendations For shannah Xataface versions up to 2.x, upgrade to version 3.0.0 to address the issue. As a temporary workaround, consider disabling the testftp function of the Installer component until the upgrade is applied. Note that the Installer is disabled by default.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-4303

GHSA-64WV-C7JW-JW2Q

Affected Products

Xataface

References · 9

• https://github.com/shannah/xataface/releases/tag/3.0.0 · Patch
• https://github.com/shannah/xataface/commit/94143a4299e386f33bf582139cd4702571d93bde · Patch
• https://osv.dev/vulnerability/GHSA-64wv-c7jw-jw2q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4303 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4303 · Vendor Advisory
• https://github.com/shannah/xataface · Note
• https://vuldb.com/?id.217442 · Note
• https://t.me/cvenotify/41818 · Telegram Post
• https://vuldb.com/?ctiid.217442 · Note