CVE-2021-3427

2022-08-2616:15:08

Google

osv.dev

deluge web-ui

xss

crafted torrent file

data sanitisation

html interpretation

malicious torrent file

arbitrary javascript code

browser session

software

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

34.5%

JSON

The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it’s interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user’s browser session.

CPENameOperatorVersion
delugeeqdeluge-2.0b1
delugeeqdeluge-2.0.2
delugeeqdeluge-0.5.4
delugeeqdeluge-2.0.0b1
delugeeqdeluge-2.0.1
delugeeqdeluge-2.0.4
delugeeqdeluge-2.1.0.dev0
delugeeqdeluge-2.0.0
delugeeqdeluge-2.0.3
delugeeqdeluge-2.0.0.dev0

Name	Operator	Version
deluge	eq	deluge-2.0b1
deluge	eq	deluge-2.0.2
deluge	eq	deluge-0.5.4
deluge	eq	deluge-2.0.0b1
deluge	eq	deluge-2.0.1
deluge	eq	deluge-2.0.4
deluge	eq	deluge-2.1.0.dev0
deluge	eq	deluge-2.0.0
deluge	eq	deluge-2.0.3
deluge	eq	deluge-2.0.0.dev0