Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2021-32772
HistoryAug 03, 2021 - 3:15 p.m.

CVE-2021-32772

2021-08-0315:15:08
CWE-79
CWE-78
[email protected]
web.nvd.nist.gov
10
poddycast
electron
remote code execution
html injection
js injection
podcast app

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.012

Percentile

85.3%

JSON

Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allows the injection of HTML and JS code (cross-site scripting). Being an application made in electron, cross-site scripting can be scaled to remote code execution, making it possible to execute commands on the machine where the application is running. The vulnerability is patched in Poddycast version 0.8.1.

Affected configurations

Nvd
Node
electronjspoddycastMatch0.8.0
VendorProductVersionCPE
electronjspoddycast0.8.0cpe:2.3:a:electronjs:poddycast:0.8.0:*:*:*:*:*:*:*

Related

prion 1
cvelist 1
osv 1
cve 1
prion
prion
Cross site scripting
2021-08-03 15:15:00
cvelist
cvelist
CVE-2021-32772 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in helper_entries
2021-08-03 14:15:13
osv
osv
CVE-2021-32772
2021-08-03 15:15:08
cve
cve
CVE-2021-32772
2021-08-03 15:15:08

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.012

Percentile

85.3%

JSON
Related for NVD:CVE-2021-32772
prion1cvelist1osv1cve1