CVE-2021-32853

2023-02-2023:15:12

Google

osv.dev

erxes

cross-site scripting

client-side code execution

web site

software vulnerability

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.053 Low

EPSS

Percentile

93.1%

JSON

Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches.

CPENameOperatorVersion
erxeseq0.11.1
erxeseq1.2.1
erxeseq0.14.1
erxeseq0.6.0
erxeseq0.22.1
erxeseq0.5.1
erxeseq0.4.5
erxeseq0.20.13
erxeseq0.15.1
erxeseq0.5.0