CVE-2021-25926

{"id": "CVE-2021-25926", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2021-04-12T14:15:16.413", "references": [{"url": "https://github.com/SiCKRAGE/SiCKRAGE/commit/9f42426727e16609ad3d1337f6637588b8ed28e4", "tags": ["Patch", "Third Party Advisory"], "source": "vulnerabilitylab@mend.io"}, {"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25926%2C", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "vulnerabilitylab@mend.io"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user."}, {"lang": "es", "value": "En SiCKRAGE, versiones 9.3.54.dev1 versiones hasta 10.0.11.dev1, son vulnerables a un ataque de tipo Cross-Site-Scripting (XSS) Reflejado, debido a que la entrada del usuario no est\u00e1 siendo comprobada apropiadamente en la funcionalidad \"quicksearch\". Por lo tanto, un atacante puede robar el ID de sesi\u00f3n de un usuario para hacerse pasar por un usuario v\u00edctima, para llevar a cabo cualquier acci\u00f3n en el contexto del usuario"}], "lastModified": "2024-02-09T03:12:43.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sickrage:sickrage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE3C8187-9890-40AF-80B2-3B005E12249F", "versionEndExcluding": "10.0.11", "versionStartIncluding": "9.3.54"}, {"criteria": "cpe:2.3:a:sickrage:sickrage:10.0.11:dev1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "256E21C4-7299-4471-AC05-91C99C507A80"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilitylab@mend.io"}