CVE-2021-32852 : Countly, a product analytics solution, is vulnerable to cross-site scripting pri

Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11.

Published 2023-02-20 22:15:11

Updated 2023-03-06 04:35:57

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2021-32852

Count » Countly Server » Community Edition
Versions before (<) 21.11
cpe:2.3:a:count:countly_server:*:*:*:*:community:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-32852

EPSS FAQ

0.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 65 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-32852

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	2.3	6.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: High
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2021-32852

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)

References for CVE-2021-32852

https://securitylab.github.com/advisories/GHSL-2021-104-countly-server/

GHSL-2021-104: Cross-Site Scripting in countly-server - CVE-2021-32852 | GitHub Security Lab
Exploit;Third Party Advisory
https://github.com/Countly/countly-server/releases/tag/v21.11

Release v21.11 · Countly/countly-server · GitHub
Release Notes
https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/app.js#L1112

countly-server/app.js at 6b90bb775e747cabe46fe197c6a6989acc6c3417 · Countly/countly-server · GitHub
Third Party Advisory
https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/views/reset.html#L95

countly-server/reset.html at 6b90bb775e747cabe46fe197c6a6989acc6c3417 · Countly/countly-server · GitHub
Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-32852

Products affected by CVE-2021-32852

Exploit prediction scoring system (EPSS) score for CVE-2021-32852

CVSS scores for CVE-2021-32852

CWE ids for CVE-2021-32852

References for CVE-2021-32852