CVE-2021-25987

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

CVSS v3 5.0 MEDIUM
CVSS v2.0 1.9 LOW

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200	Patch Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987	Third Party Advisory
https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200	Patch Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hexo:hexo:*:*:*:*:*:node.js:*:*

History

21 Nov 2024, 05:55

Type	Values Removed	Values Added
CVSS	v2 : ~~1.9~~ v3 : ~~4.6~~	v2 : 1.9 v3 : 5.0
References	~~() https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200 - Patch, Third Party Advisory~~	() https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200 - Patch, Third Party Advisory
References	~~() https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987 - Third Party Advisory~~	() https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987 - Third Party Advisory

Information

Published : 2021-11-30 14:15

Updated : 2024-11-21 05:55

NVD link : CVE-2021-25987

Mitre link : CVE-2021-25987

CVE.ORG link : CVE-2021-25987

JSON object : View

Products Affected

hexo

hexo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-25987", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilitylab@mend.io", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.5}]}, "published": "2021-11-30T14:15:07.530", "references": [{"url": "https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200", "tags": ["Patch", "Third Party Advisory"], "source": "vulnerabilitylab@mend.io"}, {"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987", "tags": ["Third Party Advisory"], "source": "vulnerabilitylab@mend.io"}, {"url": "https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "vulnerabilitylab@mend.io", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post \u201cbody\u201d and \u201ctags\u201d don\u2019t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code."}, {"lang": "es", "value": "Hexo versiones 0.0.1 a 5.4.0, son vulnerables a un ataque de tipo XSS almacenado. Los post \"body\" y \"tags\" no sanean el javascript malicioso durante la generaci\u00f3n de la p\u00e1gina web. Un atacante local no privilegiado puede inyectar c\u00f3digo arbitrario"}], "lastModified": "2024-11-21T05:55:44.413", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hexo:hexo:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2C801F4C-6A2C-4D13-AF6C-9F0490FBEA8B", "versionEndIncluding": "5.4.0", "versionStartIncluding": "0.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilitylab@mend.io"}