CVE-2021-23824

Published: Jan 13, 2022

Modified: Sep 16, 2024

PUBLISHED

CVSS v3.1

6.5

MEDIUM

Description

This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.

Vendor	Product	Versions
n/a	Crow	affected `unspecified - < 0.3+4`

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

References

https://github.com/CrowCpp/Crow/pull/317

x_refsource_MISC

https://github.com/CrowCpp/Crow/releases/tag/v0.3%2B4

x_refsource_MISC

https://snyk.io/vuln/SNYK-UNMANAGED-CROW-2336164

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2021-23824

Description

Affected Products

CVSS v3.1 Details

References