Lucene search

[email protected]CVE-2021-46827

HistoryJul 13, 2022 - 5:15 a.m.

CVE-2021-46827

2022-07-1305:15:07

CWE-79

[email protected]

web.nvd.nist.gov

xss

oxygen xml webhelp

cve-2021-46827

vulnerability

javascript

nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.3%

JSON

An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals (in online documentation generated using Oxygen XML WebHelp) allows attackers to execute JavaScript by convincing a user to type specific text in the WebHelp output search field.

Affected configurations

NVD

Node

syncoxygen_publishing_engineRange<22.1

syncoxygen_publishing_engineMatch22.12020061014

syncoxygen_publishing_engineMatch22.12020072823

syncoxygen_publishing_engineMatch22.12020100801

syncoxygen_publishing_engineMatch22.12020121711

syncoxygen_publishing_engineMatch23.12021040717

syncoxygen_publishing_engineMatch23.12021060401

syncoxygen_xml_authorRange<22.1

syncoxygen_xml_authorMatch22.12020061102

syncoxygen_xml_authorMatch22.12020072902

syncoxygen_xml_authorMatch22.12020100710

syncoxygen_xml_authorMatch22.12020121713

syncoxygen_xml_authorMatch23.12021030206

syncoxygen_xml_authorMatch23.12021040908

syncoxygen_xml_authorMatch23.12021061407

syncoxygen_xml_developerRange<22.1

syncoxygen_xml_developerMatch22.12020061102

syncoxygen_xml_developerMatch22.12020072902

syncoxygen_xml_developerMatch22.12020100710

syncoxygen_xml_developerMatch22.12020121713

syncoxygen_xml_developerMatch23.12021030206

syncoxygen_xml_developerMatch23.12021040908

syncoxygen_xml_developerMatch23.12021061407

syncoxygen_xml_editorRange<22.1

syncoxygen_xml_editorMatch22.12020061102

syncoxygen_xml_editorMatch22.12020072902

syncoxygen_xml_editorMatch22.12020100710

syncoxygen_xml_editorMatch22.12020121713

syncoxygen_xml_editorMatch23.12021030206

syncoxygen_xml_editorMatch23.12021040908

syncoxygen_xml_editorMatch23.12021061407

syncoxygen_xml_webhelpRange<22.1

syncoxygen_xml_webhelpMatch22.12020061014

syncoxygen_xml_webhelpMatch22.12020072412

syncoxygen_xml_webhelpMatch22.12020100208

syncoxygen_xml_webhelpMatch22.12020121713

syncoxygen_xml_webhelpMatch23.12021030210

syncoxygen_xml_webhelpMatch23.12021040711

syncoxygen_xml_webhelpMatch23.12021060306

CPENameOperatorVersion
sync:oxygen_publishing_enginesync oxygen publishing enginelt22.1
sync:oxygen_publishing_enginesync oxygen publishing engineeq23.1
sync:oxygen_xml_authorsync oxygen xml authorlt22.1
sync:oxygen_xml_authorsync oxygen xml authoreq23.1
sync:oxygen_xml_developersync oxygen xml developerlt22.1
sync:oxygen_xml_developersync oxygen xml developereq23.1
sync:oxygen_xml_editorsync oxygen xml editorlt22.1
sync:oxygen_xml_editorsync oxygen xml editoreq23.1
sync:oxygen_xml_webhelpsync oxygen xml webhelplt22.1
sync:oxygen_xml_webhelpsync oxygen xml webhelpeq23.1

CPE	Name	Operator	Version
sync:oxygen_publishing_engine	sync oxygen publishing engine	lt	22.1
sync:oxygen_publishing_engine	sync oxygen publishing engine	eq	23.1
sync:oxygen_xml_author	sync oxygen xml author	lt	22.1
sync:oxygen_xml_author	sync oxygen xml author	eq	23.1
sync:oxygen_xml_developer	sync oxygen xml developer	lt	22.1
sync:oxygen_xml_developer	sync oxygen xml developer	eq	23.1
sync:oxygen_xml_editor	sync oxygen xml editor	lt	22.1
sync:oxygen_xml_editor	sync oxygen xml editor	eq	23.1
sync:oxygen_xml_webhelp	sync oxygen xml webhelp	lt	22.1
sync:oxygen_xml_webhelp	sync oxygen xml webhelp	eq	23.1

References

www.oxygenxml.com/security/advisory/SYNC-2021-072301.html

Social References

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.3%

JSON

Related for CVE-2021-46827

cvelist1 nvd1 prion1