Vulnerability Details : CVE-2021-32851
Potential exploit
Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusted menus. This issue is patched in version 0.18.1
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2021-32851
- cpe:2.3:a:mind-elixir_project:mind-elixir:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-32851
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 36 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-32851
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST | |
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
GitHub, Inc. |
CWE ids for CVE-2021-32851
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
References for CVE-2021-32851
-
https://github.com/ssshooter/mind-elixir-core/blob/79942a68b14c8875ab7d270b1ad25bfff351b04c/src/plugin/contextMenu.js#L13
mind-elixir-core/contextMenu.js at 79942a68b14c8875ab7d270b1ad25bfff351b04c · ssshooter/mind-elixir-core · GitHubThird Party Advisory
-
https://github.com/ssshooter/mind-elixir-core/commit/073485269ac83af24371f35bd08507defa885655
fix: prevent XSS · ssshooter/mind-elixir-core@0734852 · GitHubPatch
-
https://securitylab.github.com/advisories/GHSL-2021-1047_Mind-elixir/
GHSL-2021-1047: Cross-Site Scripting (XSS) in Mind-elixir - CVE-2021-32851 | GitHub Security LabExploit;Third Party Advisory
Jump to