CVE-2021-3914

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
6.1MEDIUM
EPSS
0.5%
top 34.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat Build OF QuarkusRedhat Openshift Application Runtimes
Timeline
PublishedAug 25
Latest updateAug 26

Description

It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶CVEListV5smallrye-healthNot-Known

🔴Vulnerability Details

3
OSV
SmallRye Health UI Cross-site Scripting vulnerability↗2022-08-26
▶
GHSA
SmallRye Health UI Cross-site Scripting vulnerability↗2022-08-26
▶
CVEList
CVE-2021-3914: It was found that the smallrye health metrics UI component did not properly sanitize some user inputs↗2022-08-25
▶

📋Vendor Advisories

1
Red Hat
smallrye-health-ui: persistent cross-site scripting in endpoint↗2021-10-27
▶