CVE-2021-45085 — Cross-site Scripting in Epiphany

CWE-79 — Cross-site Scripting7 documents6 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 47.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Gnome EpiphanyDebian Linux
Timeline
PublishedDec 16
Latest updateAug 10

Description

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDgnome/epiphany41.0 — 41.1+1

Also affects: Debian Linux 10.0, 11.0

Patches

Patch: gitlab.gnome.org ↗Patch: gitlab.gnome.org ↗

🔴Vulnerability Details

4
OSV
epiphany-browser vulnerabilities↗2022-08-10
▶
GHSA
GHSA-w4w9-rwjc-mvgm: XSS can occur in GNOME Web (aka Epiphany) before 40↗2021-12-17
▶
CVEList
CVE-2021-45085: XSS can occur in GNOME Web (aka Epiphany) before 40↗2021-12-16
▶
OSV
CVE-2021-45085: XSS can occur in GNOME Web (aka Epiphany) before 40↗2021-12-16
▶

📋Vendor Advisories

2
Ubuntu
GNOME Web vulnerabilities↗2022-08-10
▶
Debian
CVE-2021-45085: epiphany-browser - XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via a...↗2021
▶
CVE-2021-45085 — Cross-site Scripting in Gnome Epiphany | cvebase